Looker CORS API OAuth Pattern (Direct Browser Auth)

This skill describes the Direct Browser OAuth pattern for Looker. It allows frontend applications to authenticate users directly against a Looker instance and make secure API calls via CORS without requiring a custom backend proxy.

1. The Core Pattern

The pattern leverages Looker's built-in OAuth2 support with PKCE (Proof Key for Code Exchange) to safely perform the authentication flow entirely in the browser.

Architectural Components

1. Browser Application: The frontend app that performs the OAuth flow and makes direct fetch calls to the Looker API.
2. Looker Auth Server: Handles user login, consent, and issues access tokens.
3. Looker API: Serves data directly to the browser via CORS.

2. The OAuth2 + PKCE Flow

Because a browser application is a "public client" and cannot store secrets, PKCE is used to secure the authorization code exchange.

1. Code Challenge Generation: The app generates a cryptographically random code_verifier and its SHA-256 hash, the code_challenge.
2. Redirect to Looker: The app redirects the user to Looker's /auth endpoint with parameters: