Authorization code

For the authorization code flow, calling the token endpoint is the second step of the flow. HTTP POST is used for the token endpoint.

Example: http://127.0.0.1:8080/oidc/tenant1/token-endpoint

Request parameters

These parameters must be posted as a part of the URL-encoded form values.

Note

Note: Mandatory request parameters can be configured on each OIDC provider. Mandatory values below are the default behaviour.

Parameter	Description	Mandatory
code	The value that was returned from the authorization endpoint.	true
client_id	Identifies the client and must match the value configured in FortifiedID Integrity.	false
client_secret	Authenticates the client and must match the value configured in FortifiedID Integrity.	false
grant_type	Supported value is authorization_code.	false
redirect_uri	Specifies the redirect location. It must match the value configured in FortifiedID Integrity.	true
code_verifier	Required if code_challenge was used in the authorization endpoint request.	false

When token_endpoint_auth_methods is omitted on the RP, existing Basic/POST authentication and authorization-code requests using PKCE without client authentication retain their behavior. An explicit list requires one of its allowed methods even when PKCE is used. A request with neither accepted client authentication nor PKCE is rejected.

If the authorization request used code_challenge, include code_verifier in the token request regardless of the client authentication method. Include client_id for PKCE-only and client_secret_post requests so Access can resolve the RP. For JWT authentication, client_id may be omitted; if supplied, it must match the assertion.

See Client authentication for JWT assertion parameters, verification keys and replay protection.

Client authentication methods

Access supports the following client authentication methods for authorization-code requests:

Parameters

Method	Description
client_secret_basic	Send the client ID and secret in the Basic Authorization header.
client_secret_post	Send client_id and client_secret in the POST request body.
client_secret_jwt	Send a JWT assertion signed with the client's shared secret using HS256.
private_key_jwt	Send a JWT assertion signed with the client's private key using RS256.

Example

The OP discovery response lists methods enabled by its configured RPs. For example, if all four methods are enabled:

{
  "token_endpoint_auth_methods_supported": [
    "client_secret_basic",
    "client_secret_post",
    "client_secret_jwt",
    "private_key_jwt"
  ],
  "token_endpoint_auth_signing_alg_values_supported": ["HS256", "RS256"]
}