Authorization code flow

For every login attempt, generate:

• A high-entropy state value to bind the request to the callback
• A nonce value to bind identity assertions to the request
• A high-entropy PKCE code_verifier
• A code_challenge, calculated as the base64url-encoded SHA-256 digest of the verifier

Store the values in a short-lived, server-protected transaction.

A successful callback contains code and state. Compare state with the stored value using a timing-safe comparison where possible. Reject missing, reused, expired, or mismatched transactions.

An unsuccessful callback contains error and may contain error_description. Log only a safe internal correlation ID and show the user a recoverable message.

Send a server-to-server form request:

Client credentials may also be accepted in the form body where configured, but HTTP Basic keeps credentials separate from the grant parameters.

Use the response to create a local website session, then remove the one-time OAuth transaction.

Exchange a valid refresh token with grant_type=refresh_token at /oauth2/token. Store refresh tokens only on the server. When the integration no longer needs a token, revoke it at /oauth2/revoke and invalidate the local session.