@RegisterPlugin(name = "myappOAuthProvider", description = "MyApp OAuth provider")
public class MyAppOAuthProvider implements OAuthProvider, Initializer {

    @Inject("oauthService")
    private OAuthService oauthService;

    @Override
    public void init() {
        // Register this provider with the OAuth service at startup.
        oauthService.registerProvider(this);
    }

    /**
     * Must return the key used in oauthConfig.providers.
     * The OAuth endpoints derive the provider name from the URL path:
     *   /auth/oauth/authorize/myapp  →  getProviderName() == "myapp"
     */
    @Override
    public String getProviderName() { return "myapp"; }

    /**
     * Build the ScribeJava OAuth20Service for this provider.
     * Use any ScribeJava OAuth20Api subclass or a custom implementation.
     */
    @Override
    public OAuth20Service buildService(String clientId, String secret,
                                       String callbackUrl, String scope) {
        return new ServiceBuilder(clientId)
                .apiSecret(secret)
                .callback(callbackUrl)
                .defaultScope(scope)
                .build(MyAppApi.instance());
    }

    /**
     * Fetch the user profile using the access token.
     * Return a BsonDocument with: email, name, providerId, avatarUrl.
     */
    @Override
    public BsonDocument fetchUserProfile(OAuth20Service service, String accessToken)
            throws Exception {
        // Call your provider's user-info endpoint and map the response fields.
        return new BsonDocument()
                .append("email",      new BsonString("user@example.com"))
                .append("name",       new BsonString("Display Name"))
                .append("providerId", new BsonString("12345"))
                .append("avatarUrl",  BsonNull.VALUE);
    }
}

oauthConfig:
  enabled: true
  api-base-url: https://api.example.com
  frontend-success-url: https://app.example.com/app
  frontend-error-url:   https://app.example.com/login?error=oauth_error

  providers:
    myapp:
      enabled: true
      client-id:     "…"
      client-secret: "…"
      scope:         "read:profile"