@lunch-money/developer-docs 2.11.2-preview.7 → 2.11.2-preview.8

package/docs/oauth/sample-applications.md

@@ -25,7 +25,7 @@ Use a sample application to see Lunch Money OAuth working end to end before you
 > The sample uses a fixed demonstration user and in-memory stores. It does not provide real application authentication, durable multi-user isolation, production credential storage, deployment configuration, or operational controls. Review its [security guidance](https://github.com/lunch-money/lm-oauth-confidential-node-example/blob/main/SECURITY.md) and [production checklist](https://github.com/lunch-money/lm-oauth-confidential-node-example/blob/main/PRODUCTION_CHECKLIST.md) before adapting any part of it.
 
 <!-- BEGIN GENERATED OAUTH SAMPLE WALKTHROUGH -->
-<!-- Source: lunch-money/lm-oauth-confidential-node-example@018125fb2a5869a63c7d16d760af79cef3843429:docs/WALKTHROUGH.md -->
+<!-- Source: lunch-money/lm-oauth-confidential-node-example@567516d5e32d89576323119bec7f40a7bee007b7:docs/WALKTHROUGH.md -->
 ## Try OAuth with your Lunch Money account
 
 Use this walkthrough to authorize a real Lunch Money OAuth client, call the Lunch Money API, optionally refresh its credentials, revoke access, and repeat the flow. The sample is a confidential, server-side web client built with Node.js and TypeScript.
@@ -100,11 +100,11 @@ export OAUTH_REDIRECT_URI='http://localhost:4002/oauth/callback'
 export LUNCH_MONEY_API_BASE_URL='{{LUNCH_MONEY_API_BASE_URL}}'
 ```
 
-The Developer Portal replaces `{{LUNCH_MONEY_API_BASE_URL}}` with the API base URL for the environment where you registered the client. If you are reading this walkthrough in the sample repository, use the API base URL provided with your Lunch Money OAuth access. The sample uses that one value for OAuth discovery, token operations, and Lunch Money API requests. A real application should also use [OAuth discovery](https://lunchmoney.dev/oauth/authorization-code#configure-lunch-money-with-discovery) instead of hard-coding authorization, token, and revocation endpoint URLs. `PORT` is optional and defaults to `4002`.
+The Developer Portal replaces `{{LUNCH_MONEY_API_BASE_URL}}` with the API base URL for the environment where you registered the client, so the alpha guide configures alpha explicitly. If you are reading this walkthrough in the sample repository with a production client, omit the `LUNCH_MONEY_API_BASE_URL` export; the sample defaults to `https://api.lunchmoney.dev`. For a beta or alpha client, use the exact URL supplied by Lunch Money. The client registration and API base URL must belong to the same environment. The sample uses that value for OAuth discovery, token operations, and Lunch Money API requests. A real application should also use [OAuth discovery](https://lunchmoney.dev/oauth/authorization-code#configure-lunch-money-with-discovery) instead of hard-coding authorization, token, and revocation endpoint URLs. `PORT` is optional and defaults to `4002`.
 
 `SESSION_SECRET` is also optional for this local sample. If it is absent, the process creates a new random cookie-signing secret when it starts. Because all browser sessions, authorization attempts, and credentials are held in memory and cleared on restart, the generated secret can be cleared at the same time. A production application must instead provide a strong `SESSION_SECRET`, keep it stable across restarts, and not rotate it for each OAuth authorization.
 
-Alternatively, copy [`.env.example`](https://github.com/lunch-money/lm-oauth-confidential-node-example/blob/018125fb2a5869a63c7d16d760af79cef3843429/.env.example) to `.env` as described in [Load settings from a `.env` file](https://github.com/lunch-money/lm-oauth-confidential-node-example/blob/018125fb2a5869a63c7d16d760af79cef3843429/README.md#load-settings-from-a-env-file).
+Alternatively, copy [`env.example`](https://github.com/lunch-money/lm-oauth-confidential-node-example/blob/567516d5e32d89576323119bec7f40a7bee007b7/env.example) to `.env` as described in [Load settings from a `.env` file](https://github.com/lunch-money/lm-oauth-confidential-node-example/blob/567516d5e32d89576323119bec7f40a7bee007b7/README.md#load-settings-from-a-env-file).
 
 > [!WARNING]
 > **Keep credentials private**
@@ -195,7 +195,7 @@ When access is still active, revoke it first through **Disconnect active budget*
 
 After the flow succeeds, connect each action you performed to the code that implemented it, then decide how those responsibilities fit into your own application.
 
-Before adapting the code, read the repository's [OAuth code guide](https://github.com/lunch-money/lm-oauth-confidential-node-example/blob/018125fb2a5869a63c7d16d760af79cef3843429/src/oauth/README.md), [security model](https://github.com/lunch-money/lm-oauth-confidential-node-example/blob/018125fb2a5869a63c7d16d760af79cef3843429/SECURITY.md), [production checklist](https://github.com/lunch-money/lm-oauth-confidential-node-example/blob/018125fb2a5869a63c7d16d760af79cef3843429/PRODUCTION_CHECKLIST.md), and [troubleshooting guide](https://github.com/lunch-money/lm-oauth-confidential-node-example/blob/018125fb2a5869a63c7d16d760af79cef3843429/TROUBLESHOOTING.md).
+Before adapting the code, read the repository's [OAuth code guide](https://github.com/lunch-money/lm-oauth-confidential-node-example/blob/567516d5e32d89576323119bec7f40a7bee007b7/src/oauth/README.md), [security model](https://github.com/lunch-money/lm-oauth-confidential-node-example/blob/567516d5e32d89576323119bec7f40a7bee007b7/SECURITY.md), [production checklist](https://github.com/lunch-money/lm-oauth-confidential-node-example/blob/567516d5e32d89576323119bec7f40a7bee007b7/PRODUCTION_CHECKLIST.md), and [troubleshooting guide](https://github.com/lunch-money/lm-oauth-confidential-node-example/blob/567516d5e32d89576323119bec7f40a7bee007b7/TROUBLESHOOTING.md).
 <!-- END GENERATED OAUTH SAMPLE WALKTHROUGH -->
 
 ## Understand the confidential teaching code
@@ -237,6 +237,19 @@ visible or selectable. Applications that add their own sign-in system must put
 that pair inside the authenticated application user's storage and ownership
 boundary.
 
+The native sample defaults to the production API at
+`https://api.lunchmoney.dev`. This Developer Portal is configured for
+`{{LUNCH_MONEY_API_BASE_URL}}`. If this differs from production, set the
+sample's API-base override before starting it:
+
+```sh
+export EXPO_PUBLIC_LUNCH_MONEY_API_BASE_URL='{{LUNCH_MONEY_API_BASE_URL}}'
+```
+
+Register the OAuth client in the same environment as that API base URL. A
+client registration from one environment cannot be used with another
+environment's authorization server and API.
+
 The native repository's [walkthrough](https://github.com/lunch-money/lm-oauth-native-expo-example/blob/main/docs/WALKTHROUGH.md) is the canonical hands-on guide;
 complete the registration, development-build, authorization, `/v2/me`,
 optional refresh, revocation, and local-reset walkthrough there.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunch-money/developer-docs",
-  "version": "2.11.2-preview.7",
+  "version": "2.11.2-preview.8",
   "description": "Developer documentation content for Lunch Money APIs",
   "exports": {
     ".": "./package.json",