technical description of government as an oauth provider

readme.md

Government OAuth

OAuth is a popular technology that companies like Facebook and Twitter have used to integrate with applications developed by outside parties (e.g. "Sign in with Twitter")

Goals:

• "Sign in with your City of XYZ account" on community/third party developed web apps
• per-transaction/fixed rate/etc payments from gov to NGO developers
• lightweight tech procurement via API (as opposed to the system currently in place: see http://requestforawesome.com)
• ability to start and cancel contracts eeasily -- think Heroku Add-ons for government services
• A government hosted developer page that is as user friendly as http://stripe.com

Requirements:

• http://developers.somecity.org should essentially provide the same service as http://instagram.com/developer/
• developer site + underlying framework (database etc) should be SaaS that early adopter cities can easily try out

Example workflow:

• Bill, a software developer living in Oakland, visits http://developers.cityofoakland.org and sees that Oakland has an API for submitting new business applications. For each valid business application submitted Oakland will pay 1 dollar to the application developer.
• Bill thinks this is rad and registers and developer account. He enters in his home address so the city can send him checks.
• Bill drinks a bunch of coffee and spends a couple of weeks writing a new app: newOaklandBusiness.com. His site lets you easily file a new business application digitally. He submits his finished application to the city and waits for a review.
• A city of Oakland procurement officer (or maybe another type of employee?) reviews Bill's new app submission and decides it meets the criteria. They mark Bill's application as 'approved' which means Oakland residents are now allowed to sign in through Bill's app.
• A few months later Lisa, another Oakland resident, is trying to open a coffee shop and finds newOaklandBusiness.com through a google search. She signs in with his City of Oakland account (think of "Sign in with Twitter/Facebook" here) and enters her new business information and submits her application for free
• A city of Oakland employee gets an email with the new business application, prints it out, gives it to the business department and then marks the application as 'processed' in an internal software system (this part is loosely defined at this point).
• Bill's account is credited with 1 dollar

Some specific points regarding this example:

• On they city side they would to do the following things:
  • Purchase and host the developer software
  • Appoint someone to review app submissions
  • Integrate the third party application APIs with internal business process and billing systems
• Benefits of this approach:
  • Any developer who builds and app that fulfills the requirements set forth by the city is eligible to get approved
  • Rules and regulations will have to be established though:
    • What is the max $ amount that can be earned in a single month?
    • If an app exceeds the earnings cap does it get disabled and forced to go through the regular competitive bidding process?
    • What if there are already 10 applications that fulfill an API? Is the city forced to accept and 11th?
    • If an application gets rejected should the rejection statement (and employee who made it) be public?
  • Since the dollars amounts will be low (relative to government software today) this system can work within current discretionary budget limits

Would there be a code review for the new app? What if someone is transmitting sensitive data and the data is duplicated to a private seekret database.

@EhevuTov thats a good question. for sensitive information like SSN or home address the users account on City of Oakland could have a private profile that third party developers wouldn't have access to but could assume would be available to the city. e.g. if I'm filling out a new business application on newOaklandBusiness.com I wouldn't need to fill out the SSN field - it would instead say 'your SSN will be included automatically from your city of oakland account - make sure it is up to date there' or something along those lines

the other point to make is that business licenses might not be the easiest thing to get started with in a system like this... perhaps there a use case that has even less complexity

I like the part of this about gov't o-auth, and using a city account to sign into civic apps. But you kinda lost me at "and then the city hosts and integrates the software". Maybe (maybe) that could work at a big city like oakland, but i think we should be building solutions that could work for < 100,000 cities & towns.

@lukec I think a hosted solution would be nice and a installable solution would also be nice. ideally a platform like this would be publicly funded and a small company could form to support it