UAP flow lifecycle and security

UAP credentials and flow secrets are server-only values. The browser participates through your application API, not by calling the Vine Auth API directly.

Server boundary

text

Browser -> your backend -> auth-api.vineeid.com
Browser <- your backend <- auth-api.vineeid.com

Store flow_secret against flow_id in a server-side database, cache, or transient store with an expiry. Return only the QR code and flow ID to the browser.

Handle results

Status	Backend action
`pending`	Continue polling or wait for your integration callback.
`approved`	Read granted data, validate it for your use case, then create the application session or continue the operation.
`rejected`	Stop the operation and present a retry path.
`expired`	Delete the stored secret and initialize a new flow when needed.

Missing data

initFlow can report requested scopes that the user has not supplied. Treat this as a user-resolution state, not as an approved identity result.

Retry safely

Do not repeatedly initialize flows for the same user action. Reuse a live flow where appropriate, remove server-side flow state after a terminal result, and keep UI polling intervals under your control.