<a href="/auth/vk/start" class="btn-vk">
  Войти через ВКонтакте
</a>

<?php
session_start();

$clientId    = getenv('VK_CLIENT_ID');
$redirectUri = 'https://example.com/auth/vk/callback';

// Генерируем PKCE
$codeVerifier  = bin2hex(random_bytes(32)); // 64 символа
$codeChallenge = rtrim(strtr(base64_encode(hash('sha256', $codeVerifier, true)), '+/', '-_'), '=');

$state = bin2hex(random_bytes(16));

$_SESSION['vk_code_verifier'] = $codeVerifier;
$_SESSION['vk_state']         = $state;

$params = http_build_query([
    'response_type'         => 'code',
    'client_id'             => $clientId,
    'redirect_uri'          => $redirectUri,
    'scope'                 => 'email',        // при необходимости: phone
    'state'                 => $state,
    'code_challenge'        => $codeChallenge,
    'code_challenge_method' => 'S256',
    'v'                     => '5.199',        // версия API
]);

header('Location: https://id.vk.com/authorize?' . $params);
exit;

<?php
session_start();

$clientId     = getenv('VK_CLIENT_ID');
$clientSecret = getenv('VK_CLIENT_SECRET');
$redirectUri  = 'https://example.com/auth/vk/callback';

// 1. Проверка state (защита от CSRF)
if (!isset($_GET['state'], $_SESSION['vk_state']) ||
    !hash_equals($_SESSION['vk_state'], $_GET['state'])) {
    http_response_code(400);
    exit('Invalid state');
}

if (empty($_GET['code'])) {
    http_response_code(400);
    exit('Authorization code missing');
}

$code         = $_GET['code'];
$deviceId     = $_GET['device_id'] ?? ''; // VK может вернуть device_id
$codeVerifier = $_SESSION['vk_code_verifier'] ?? '';
unset($_SESSION['vk_state'], $_SESSION['vk_code_verifier']);

// 2. Обмен кода на access_token (server-to-server)
$tokenUrl = 'https://id.vk.com/oauth2/auth';
$post = http_build_query([
    'grant_type'    => 'authorization_code',
    'code'          => $code,
    'client_id'     => $clientId,
    'client_secret' => $clientSecret,
    'redirect_uri'  => $redirectUri,
    'code_verifier' => $codeVerifier,
    'device_id'     => $deviceId,
]);

$ch = curl_init($tokenUrl);
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => $post,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT        => 15,
    CURLOPT_HTTPHEADER     => ['Content-Type: application/x-www-form-urlencoded'],
]);
$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($httpCode !== 200 || !$response) {
    http_response_code(502);
    exit('Token exchange failed');
}

$tokenData = json_decode($response, true);
$accessToken = $tokenData['access_token'] ?? null;
$userId      = $tokenData['user_id'] ?? null;

if (!$accessToken) {
    http_response_code(502);
    exit('No access_token');
}

// 3. Получаем профиль пользователя
$profileUrl = 'https://api.vk.com/method/users.get?' . http_build_query([
    'user_ids'     => $userId,
    'fields'       => 'first_name,last_name,photo_100',
    'access_token' => $accessToken,
    'v'            => '5.199',
]);

$profileJson = file_get_contents($profileUrl);
$profile     = json_decode($profileJson, true)['response'][0] ?? null;

if (!$profile) {
    http_response_code(502);
    exit('Profile fetch failed');
}

// 4. Здесь создаём/находим пользователя в своей БД и открываем сессию
// $user = findOrCreateUser($profile['id'], $profile['first_name'], ...);

$_SESSION['user'] = [
    'vk_id'     => $profile['id'],
    'first_name'=> $profile['first_name'],
    'last_name' => $profile['last_name'],
    'photo'     => $profile['photo_100'] ?? null,
];

header('Location: /profile');
exit;

// app.js
const express = require('express');
const axios = require('axios');
const crypto = require('crypto');
const session = require('express-session');

const app = express();
app.use(session({
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: true,
  cookie: { httpOnly: true, secure: true, sameSite: 'lax' }
}));

const CLIENT_ID     = process.env.VK_CLIENT_ID;
const CLIENT_SECRET = process.env.VK_CLIENT_SECRET;
const REDIRECT_URI  = 'https://example.com/auth/vk/callback';

app.get('/auth/vk/start', (req, res) => {
  const verifier = crypto.randomBytes(32).toString('hex');
  const challenge = crypto
    .createHash('sha256')
    .update(verifier)
    .digest('base64')
    .replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
  const state = crypto.randomBytes(16).toString('hex');

  req.session.vkVerifier = verifier;
  req.session.vkState = state;

  const params = new URLSearchParams({
    response_type: 'code',
    client_id: CLIENT_ID,
    redirect_uri: REDIRECT_URI,
    scope: 'email',
    state,
    code_challenge: challenge,
    code_challenge_method: 'S256',
    v: '5.199'
  });

  res.redirect('https://id.vk.com/authorize?' + params.toString());
});

app.get('/auth/vk/callback', async (req, res) => {
  const { code, state, device_id } = req.query;
  if (!state || state !== req.session.vkState) return res.status(400).send('Invalid state');

  const verifier = req.session.vkVerifier;
  delete req.session.vkState;
  delete req.session.vkVerifier;

  try {
    const body = new URLSearchParams({
      grant_type: 'authorization_code',
      code,
      client_id: CLIENT_ID,
      client_secret: CLIENT_SECRET,
      redirect_uri: REDIRECT_URI,
      code_verifier: verifier,
      device_id: device_id || ''
    });

    const { data } = await axios.post('https://id.vk.com/oauth2/auth', body.toString(), {
      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
      timeout: 15000
    });

    const { access_token, user_id } = data;

    const profile = await axios.get('https://api.vk.com/method/users.get', {
      params: {
        user_ids: user_id,
        fields: 'first_name,last_name,photo_100',
        access_token,
        v: '5.199'
      },
      timeout: 15000
    });

    const user = profile.data.response[0];
    // TODO: найти или создать пользователя в БД
    req.session.user = { vk_id: user.id, first_name: user.first_name, last_name: user.last_name };

    res.redirect('/profile');
  } catch (err) {
    console.error(err.response?.data || err.message);
    res.status(502).send('Ошибка авторизации');
  }
});

app.listen(3000);

// псевдокод
$user = db_find_user_by_vk_id($vkId);

if (!$user) {
    $user = db_create_user([
        'vk_id'      => $vkId,
        'first_name' => $profile['first_name'],
        'last_name'  => $profile['last_name'],
        'email'      => $emailFromToken ?? null, // если запросили scope=email
        'created_at' => date('Y-m-d H:i:s')
    ]);
}

open_user_session($user['id']);