# Authorization code

Documentation owner: product `access`; documentation version: `3.9.1`.
Source: `content/products/access/3.9.1/key-components/modules/oidc/token-endpoint/authorization-code.mdx` at commit `eaf7a020437971baeee95e87eaf963636040ac71`.

For the authorization code flow, calling the token endpoint is the second step of the flow. HTTP POST is used for the token endpoint.

```
Example: http://127.0.0.1:8080/oidc/tenant1/token-endpoint
```

#### Request parameters

These parameters must be posted as a part of the URL-encoded form values.

:::note
**Note:** Mandatory request parameters can be configured on each OIDC provider. Mandatory values below are the default behaviour.
:::

| Parameter | Description | Mandatory |
| --- | --- | --- |
| `code` | The value that was returned from the authorization endpoint. | true |
| `client_id` | Identifies the client and must match the value configured in FortifiedID Integrity. | false |
| `client_secret` | Authenticates the client and must match the value configured in FortifiedID Integrity. | false |
| `grant_type` | Supported value is `authorization_code`. | false |
| `redirect_uri` | Specifies the redirect location. It must match the value configured in FortifiedID Integrity. | true |
| `code_verifier` | Required if `code_challenge` was used in the authorization endpoint request. | false |

The token endpoint accepts either:

* client authentication with `client_secret_basic` or `client_secret_post`
* PKCE with `code_verifier`

If `code_verifier` is present, `client_secret` is not required. If neither client authentication nor PKCE is used, the request is rejected.

When PKCE or `client_secret_post` is used, `client_id` must still be included so the relying party can be resolved.

#### Client authentication methods

:::note
**Parameter:** `token_endpoint_auth_methods_supported`

in discovery\_meta configuration section.
:::

FortifiedID Integrity supports the following methods:

### Parameters

| Method                | Description                                                                         |
| --------------------- | ----------------------------------------------------------------------------------- |
| `client_secret_basic` | Provide 'clientid' and 'client\_secret' in the Authorization header. (Basic auth)   |
| `client_secret_post`  | Provide 'clientid' and 'client\_secret' as parameters in the POST request body.     |
| `none`                | For PKCE use. Provide the 'code\_verifier' as a parameter in the POST request body. |

### Example

```json
"discovery_meta": {
    ...
    "token_endpoint_auth_methods_supported" : 
        ["client_secret_post", "client_secret_basic"]
    ...
}
```