Authorization request
The parameters to send to the authorization endpoint.
Redirect the user’s browser to https://oidc-sandbox.a3bc.io/oauth2/auth with these parameters.
| Parameter | Required | Description |
|---|---|---|
response_type |
yes | code |
client_id |
yes | Identifier issued by A3BC. |
redirect_uri |
yes | Strictly identical to a registered URI. |
scope |
yes | Space-separated scopes. Must contain openid. See the scopes. |
state |
yes | Random value to compare on return (CSRF protection). |
nonce |
yes | Random value found again in the id_token (replay protection). |
acr_values |
no | One value only. See ACR. |
claims |
no | Encoded JSON with the mandatory list. See Mandatory claims. |
Example
GET /oauth2/auth
?response_type=code
&client_id=e251305f-5db8-11f1-8cb7-c8a3620c309f
&redirect_uri=https%3A%2F%2Fapp.example.com%2Fcallback
&scope=openid%20profile%20private%3Aperson%20email
&state=Zk3x...
&nonce=OEoz...
&acr_values=a3bc2
User journey
Depending on your RP configuration, the user enters an identifier or scans a QR code. If your rights allow it, private:method.qrcode or private:method.identifier forces one or the other; otherwise the IdP decides.
The QR code opens the TrustMe app through a deep link. This iOS/Android integration is the IdP’s responsibility, not yours.