Authorization code flow

1. Generate transaction values

For every login attempt, generate:

• A high-entropy state value to bind the request to the callback
• A nonce value to bind identity assertions to the request
• A high-entropy PKCE code_verifier
• A code_challenge, calculated as the base64url-encoded SHA-256 digest of the verifier

Store the values in a short-lived, server-protected transaction.

2. Redirect to authorization

3. Validate the callback

A successful callback contains code and state. Compare state with the stored value using a timing-safe comparison where possible. Reject missing, reused, expired, or mismatched transactions.

An unsuccessful callback contains error and may contain error_description. Log only a safe internal correlation ID and show the user a recoverable message.

4. Exchange the code

Send a server-to-server form request:

Client credentials may also be accepted in the form body where configured, but HTTP Basic keeps credentials separate from the grant parameters.

5. Read user information

Use the response to create a local website session, then remove the one-time OAuth transaction.

Refresh and revoke

Exchange a valid refresh token with grant_type=refresh_token at /oauth2/token. Store refresh tokens only on the server. When the integration no longer needs a token, revoke it at /oauth2/revoke and invalidate the local session.