OAuth2 access to the GraphQL my root for third-party apps — is there a registration path?

[Sam T]

Hi Kiva team,

I'm the developer of Kiva Search for Android (app_id com.woohoosoftware.kivasearch).
I'm modernising the app and have hit an authentication dead end I'd love guidance on:

The authenticated v1 endpoints (/v1/my/account.json, /v1/my/balance.json, /v1/my/loans.json, etc.) now return 404, so my existing OAuth 1.0a integration authenticates successfully but has nothing left to call. (The OAuth 1.0a token exchange itself still works — my consumer key is still valid.)

The GraphQL API's my root is described as "Exposes fields for the logged in user (via OAuth2)", which looks like the intended replacement.

I can't find any documentation on how a third-party app obtains OAuth2 credentials — build.kiva.org doesn't cover authentication.
So my questions:

Is there a way for a third-party app to register an OAuth2 client (client id/secret, redirect URI) to use the GraphQL my root on a lender's behalf?

If yes — what's the process, and which scopes cover lender balance, the lender's own loans (including repayment status), and saved searches?

If OAuth2 isn't currently open to third parties — is that planned, and is there any supported way for an app to access a consenting lender's private data in the meantime?
Does my existing OAuth 1.0a consumer key / developer account carry over to anything in the new world?

Sam
(Kiva Search — com.woohoosoftware.kivasearch, lender woohoo)

[Joe Travis]

Hi Sam,

Thanks for reaching out. It looks like you've run into some security/privacy related API deprecations that we have processed over the last couple of months.

Regarding the OAuth2 integration, we believe that there is a path forward to here, but we're not quite ready to roll it out for integration We have a couple of security concerns to deal with first and some broader organizational work to do to make it work. If we haven't gotten back to you within the week, please reach out again.

Thanks,

Joe Travis