How DocID^® works

A DocID^® login is a redirect-based flow. The user's credentials are entered on DocID^®, not on the integrating website.

Login journey

1. A visitor requests protected content on your website.
2. Your website generates a unique state value and a PKCE verifier and challenge.
3. The browser is redirected to the DocID^® authorization endpoint.
4. DocID^® authenticates the user, applies the configured verification and consent process, and asks the user to authorize the requested scopes.
5. DocID^® redirects the browser to the exact registered callback URL with a short-lived authorization code.
6. Your server validates state and exchanges the code together with the PKCE verifier.
7. Your server requests approved profile claims from the UserInfo endpoint and creates its own application session.
8. Your website grants access or adapts the experience according to its own configured rules.

Trust boundary

The browser carries redirects, but sensitive operations belong on your server. Keep the client secret, authorization code exchange, refresh tokens, and access tokens out of frontend JavaScript and browser storage.

Returning visitors

Your website decides how long its local session remains valid. When the application session expires, start a new authorization flow or use a valid refresh token from secure server-side storage.

Implement the authorization code flow