Code exchange
Callback on the redirect_uri, state check and call to the token endpoint.
The callback
A3BC redirects to your redirect_uri:
https://app.example.com/callback?code=...&state=...
On failure (consent refused, ACR not satisfied, incident), the request contains error and error_description instead of code. Always compare state with the session value before going further.
The token call
| Item | Value |
|---|---|
| Method | POST https://oidc-sandbox.a3bc.io/oauth2/token |
| Authentication | client_secret_basic: Authorization: Basic base64(client_id:client_secret) header |
Body (application/x-www-form-urlencoded) |
grant_type=authorization_code, code, redirect_uri |
The code is single-use, and the redirect_uri must be identical to the one in the authorization request. Examples in the quickstart.
The response
A JSON object containing access_token and id_token, among others. The access_token is used to call the userinfo endpoint and the document API.
Information stays available for 30 minutes after consent. If an expected claim is missing and you requested the
private:delayed_sharing scope, see delayed sharing.