···11+22+OAuth SDK Web App Example
33+=========================
44+55+This is a minimal Go web app showing how to use the OAuth client SDK.
66+77+To get started, generated a `.env` file with the following variables:
88+99+- `SESSION_SECRET` (required) is a random string for secure cookies, you can generate one with `openssl rand -hex 16`
1010+- `CLIENT_HOSTNAME` (optional) is a public web hostname at which the running web app can be reached on the public web, with `https://`. It needs to actually be reachable by remote servers, not just your local web browser; you can use a service like `ngrok` if experimenting on a laptop. Or, if you leave this blank, the app will run as a "localhost dev app".
1111+- `CLIENT_SECRET_KEY` (optional) is used to run as a "confidential" client, with client attestation. You can generate a private key with the `goat` CLI tool (`goat key generate -t P-256`)
1212+1313+And example file might look like:
1414+1515+```
1616+SESSION_SECRET=49922828917dc6ac2f2fd2cca78735c3
1717+CLIENT_SECRET_KEY=z42twLj2gZeJSeRgZ4yPyEb6Yg6nawhU2W8y2ETDDFFyvwym
1818+CLIENT_HOSTNAME=a9a7c2e14c.ngrok-free.app
1919+```
2020+2121+Then run the demo (`go run .`) and connect with a web browser.