OpenID Provider (Sandbox organisation)

Token endpoint

POST/v4/service/platform/extension/oidc/{organisationId}/{sandboxOrgId}/token

The endpoint of the OpenID Provider of a sandbox organisation. It works like the endpoint of the main organisation; the path holds the ID of the sandbox organisation after the ID of the organisation.

Exchanges the authorisation code for an ID token and an access token. Your identity and access management system calls it from its server after the redirect.

Authenticate the client with HTTP Basic (client_secret_basic): the client ID as user name and the client secret as password. Send code and the same redirect_uri as in the authorisation request, and code_verifier when the request had a code_challenge.

The provider resolves the sub here, with the identity matching attributes or the callback of the client. Both tokens are ES256 JWTs that expire after 5 minutes. Check the ID token with the JWKS of the provider.

Token endpoint

Language of the request sample

curl -X POST 'https://demo-api.igrant.io/v4/service/platform/extension/oidc/{organisationId}/{sandboxOrgId}/token' \
  -H 'Authorization: Basic <base64 of client-id:client-secret>' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'grant_type=authorization_code' \
  --data-urlencode 'code=string' \
  --data-urlencode 'redirect_uri=string' \
  --data-urlencode 'code_verifier=string'

{
  "access_token": "<access-token>",
  "token_type": "Bearer",
  "expires_in": 842,
  "id_token": "<id-token>"
}

Authorizations

Authorizationstringheaderrequired
The client ID and secret of your client: Basic <base64 of client-id:client-secret>.

Path parameters

organisationIdstringrequired
The ID of the organisation
sandboxOrgIdstringrequired
Unique identifier of the sandbox organisation.

Body

application/x-www-form-urlencoded

grant_typeenum<string>required
Only authorization_code.
Available options:authorization_code
Default:authorization_code
codestringrequired
The authorisation code from the redirect to your redirect URI.
redirect_uristringrequired
The redirect_uri of the authorisation request, exactly the same.
code_verifierstring
The PKCE code verifier. Mandatory when the authorisation request had a code_challenge.

Response

application/json

The tokens.

Headers

Cache-Controlstring
The answer holds tokens. Do not cache it.
Example:"no-store"

access_tokenstring
A signed JWT (ES256) for the UserInfo endpoint. It holds iss, sub, aud (the client ID), scope (openid), state and nonce (when the authorisation request had one). It expires after 5 minutes.
token_typestring
Always Bearer.
expires_ininteger
The seconds until the login session ends. The session ends 15 minutes after the authorisation request; after that the UserInfo endpoint refuses the access token.
id_tokenstring
A signed JWT (ES256) with iss, sub, aud (the client ID), presentation (the presented claims), iat, exp and nonce (when the authorisation request had one). It expires after 5 minutes. Check its signature with the JWKS of the provider.