* [v1 is for mobile](https://docs.nextcloud.com/server/latest/developer_manual/client_apis/LoginFlow/index.html) and is quite simple to implement
* [v2 is for desktop](https://docs.nextcloud.com/server/latest/developer_manual/client_apis/LoginFlow/index.html#login-flow-v2) and requires two endpoints
The first login API requires you to simply generate an app password and redirect to a special URL after login:
1. Client will call the `/index.php/login/flow` URL
2. You redirect or display a login form for the user (it is recommended that you ask the user to confirm that he wants to allow the app after login)
3. After login you redirect to this special URL: `nc://login/server:https://...&user:bohwaz&password:supersecret`.
Because why re-use standard URL query parameters when you can invent weird stuff, you have to use a colon instead of an equal sign. Also it seems that parameters cannot be URL-encoded, so not sure what happens if your server URL, username or password contain a special character. But aside from that it is quite straightforward.
The second API is different but is explained in the documentation, it involves extra steps. When the process finishes, the user is left to close the opened browser window, so you got to have a specific waiting page for that. The desktop app will try to request (poll) the username and password every time it receives focus again, or every 30 seconds.
6.`POST /index.php/login/v2/poll` (at this point you are logged-in)
8.`PROPFIND /remote.php/webdav/` requesting only the `d:getlastmodified` property for the root directory (depth = 0).
8.`PROPFIND /remote.php/webdav/` only for `oc:size` on the root directory and depth = 0. This could have been in previous request to make things faster.
9.`PROPFIND /remote.php/webdav/` only for `oc:size` and `d:getlastmodified` on the root directory and depth = 1 when you are clicking the button to select the folders to sync.
After you have set up the sync you get a bunch of requests:
1.`GET /status.php`
2.`PROPFIND /remote.php/webdav/` requesting only the `d:getlastmodified` property for the root directory (depth = 0)
3.`GET /ocs/v1.php/cloud/capabilities?format=json` which is now returning more stuff as you are logged-in (also note the `v1`, before it was `v2`)
4.`GET /ocs/v1.php/config?format=json`
5.`GET /ocs/v1.php/cloud/user?format=json`
6. (other requests for internal Nextcloud features)
7.`PROPFIND /remote.php/dav/files/toto/` (where toto is the username)