Best Practices

These are some best practices you should follow when integrating gw2.me into your application.

Scopes

Always require the minimal scopes your application needs to function. You can use Incremental Authorization to request more optional scopes for advanced workflows later. Do not include scopes your application might need only in the future, instead reauthorize the user once your application includes the feature that require more scopes.

State

Always use the state for User Authorization to prevent Cross-Site Request Forgery (CSRF) attacks.

Invalid Tokens

Access and refresh tokens can become invalid for a number of reasons. Handle errors in your application and either refresh invalid access tokens or restart the authorization flow to get fresh tokens.

Prompt

Do not use prompt=consent for user login (see User Authorization). Without setting the prompt users who have already authorized your application will not be show the consent screen again and the login flow is faster and less disruptive.

If you want to allow users to change the account selection, consider adding a "Manage accounts" button after login that starts the flow with prompt=consent in your application instead.

Security

Make sure your application follows security best practices and does not leak any user data.

Branding

Follow our branding guidelines.