# The User Experience

This is a fair description of what we're going for:

'We want to sell (or give away) virtual movie tickets to our VR app users, from our website.  The user purchases the tix on our site, then they put on their VR headset and open our app, and then the tickets are just ready to go for them.  They don't need to enter a code or a username and password; everything Just Works.'


# "Login with Your Oculus Account": can't be done

It looks like Oculus has not published any info about their OAuth2 endpoints for authenticating users over the web.  There are endpoints available for this, but they are undocumented and not mentioned anywhere on the official Oculus docs.  We could easily determine the structure of these endpoints (I've had a quick look: it's very similar to the facebook Oauth2 system, but not an EXACT match), but this is a dangerous road to go down.  Undocumented API usage is a huge risk; there's a high chance the API could change at any time without any warning.

From within the app, it's a completely different story.  When an Oculus user opens the Bigscreen app, the app can get the user's unique token with the Oculus Platform SDK, and can send this token to our own API endpoint. We can use this to create a Bigscreen user account. This is essentially identical to the Steam account creation endpoints.

This is useless for the web, because there's no way to retrieve the account without the same Oculus token.  Oculus users will therefore have a downgraded experience where they have to enter their username and password in the VR app before they can purchase or redeem any tickets.

Reference: https://developer.oculus.com/documentation/platform/latest/concepts/pgsg-s2s-basics/


# What does this mean for the UX?

It means we can't match an Oculus user to their Bigscreen account without them entering their username and password from within the VR app.  We have to decide if this is worth it or not from a user experience point of view. 

In addition to this, an Oculus user can't buy a ticket from the Bigscreen website without setting up an account with their email/password first.  They'd need to enter the same username and password in the VR app to login and get their inventory.


# Possible Workarounds

## In VR, user just types a short ticket code to redeem

On the web, Oculus users must create their account with an email and password.  When they buy a ticket on the website, they are given a special code (e.g. 5 digit A-Z,0-9).  To use the virtual ticket, they enter their code in the VR app.  Once they've entered the code, we can mark it as "used" within our user database.

Problems:
1. May need to deal with an increase in customer support queries.

## Just Use Facebook

Just use facebook OAuth, since it is probable that most Oculus users actually just logged in with their facebook accounts anyway.

Problems:
1. New problem: we need to get the facebook id from the Oculus Platform SDK.  Not sure if we can do this, based on what I can see in the docs.  Oculus appear to use facebook OAuth in the same way that we would.
2. We'll need a facebook app ID and go through that whole process. I beleive this ID is completely different to the ones on the Oculus Dev center.