Explanation

What StoatBoard proves — and what it does not

StoatBoard is an independent community identity intermediary. It attests that a StoatBoard user controlled a specific Stoat account during the link ceremony.

Continue with StoatBoard is not official Stoat OAuth and is not affiliated with Stoat. Applications must use StoatBoard's name and may not imply that Stoat operates, endorses or certifies the service.

Why the bot is involved

Stoat's public developer documentation describes bot and session-token authentication, but does not document an OAuth authorization service for third-party applications. A user must never paste a Stoat session token into StoatBoard or into a developer's application. The companion bot is therefore the only party in this design that observes the real Stoat author ID.

The browser creates a temporary challenge with two independent proofs: a short human code and an opaque browser secret. The user sends /link CODE to the bot, which records the Stoat author. The initiating browser then displays the detected identity and confirms the link using its secret. A copied public code alone cannot complete the link.

StoatBoard uses this same screen for normal account linking and for third-party authorization. It links to the dedicated verification server when configured and can otherwise help the user add the bot to a server they control.

Link lifecycle

requested
The browser holds the second proof.
dm_sent
The bot delivered the one-time link privately.
verified
The bot observed and stored the Stoat author ID.
confirmed
The initiating browser explicitly approved the identity.
completed
The unique Stoat ID was linked atomically.
expired / failed
No link can be completed; start a new challenge.

Codes and browser secrets are stored only as cryptographic hashes and are never written to audit logs. Linking is normally required once; later sign-ins use the existing StoatBoard account.

Two separate trust signals

Linked Stoat identity

The user proved control of the Stoat account represented by stoat_id. This does not prove the person's legal identity or continuing control forever.

Verified by StoatBoard

The application proved domain control and passed a manual review of branding, site and privacy information. It is a StoatBoard trust badge, not a Stoat endorsement.

Privacy boundary

StoatBoard shares only claims covered by the scopes shown on consent. The application receives a stable subject by default; profile, linked Stoat identity and verified email are separate permissions. Email can be unchecked, is omitted when unverified and is never replaced with a synthetic address.

The consent screen names the exact application, registered domain, owner, verification status and requested permissions. Logos are normalized and served by StoatBoard, so viewing consent does not contact the developer's image host. Consent pages contain no advertising or third-party analytics.

Revocation and suspension

Users can revoke an application at any time. Unlinking Stoat revokes every authorization and protocol artifact immediately. StoatBoard also refuses access when a user, linked identity, application owner, linked bot or application is suspended. An editorial rejection of a public bot listing does not automatically disable OAuth unless it represents a security sanction.

Legal review before public launch

The implementation and these explanations are technical controls, not a claim of legal compliance. Terms, privacy disclosures and data-processing practices require qualified legal review before the service is promoted publicly.