Skip to content
Authentication/
/
PKCE
Last updated

Authorization Code Flow with PKCE (for SPAs)

This flow is required for public clients (SPAs) where a user is present to grant consent but the application cannot securely store a client secret.

The flow has two main parts:

  • Request User Authorization
  • Exchange Authorization Code for an Access Token

Part 1: Request User Authorization

Your application must redirect the user to the eGain authorization endpoint from metadata to obtain User's Authorization Code.

  • Method: GET

  • Endpoint: Your Authorization URL (from your client application's metadata).

    • Example Base Authorization URL for a User:
      https://ai.egain.cloud/system/auth/TMPRODB88619984-U/oauth2/authorize
    • Example Base Authorization URL for a Customer:
      https://ai.egain.cloud/system/auth/TMPRODB88619984-C/oauth2/authorize

Query Parameters:

ParameterRelevanceDescription
client_idRequiredThe Client ID for your application.
response_typeRequiredMust be set to code.
redirect_uriRequiredThe URI to redirect to after the user grants or denies permission.
scopeRequiredA space-separated list of scopes. You can include any combination of scopes assigned to your client application in a single request. This allows you to generate one multi-purpose token for your entire application, or separate tokens for specific tasks, depending on your architectural needs.
stateRecommendedAn opaque value used to prevent cross-site request forgery attacks.
code_challengeRequiredA transform value of the code_verifier used for PKCE.
code_challenge_methodRequiredThe method used to generate the code_challenge. Must be S256.
  • Example Full Authorization URL for a User:
    https://ai.egain.cloud/system/auth/TMPRODB88619984-U/oauth2/authorize?client_id=b4b2c1d9-4c19-4e8a-8e7a-9a0b1c2d3e4f&response_type=code&redirect_uri=https%3A%2F%2Foauth.pstmn.io%2Fv1%2Fcallback&scope=core.aiservices.read%20core.aiservices.write&state=a1b2c3d4e5f67890&code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM&code_challenge_method=S256

Part 2: Exchange Authorization Code for an Access Token

Once your application receives the authorization code, it exchanges it for an access token through access token endpoint found in metadata.

  • Method: POST

  • Endpoint: Your Token URL (from your client application's metadata).

    • Example Base Token URL for a User:
      https://ai.egain.cloud/system/auth/TMPRODB88619984-U/oauth2/token
    • Example Base Token URL for a Customer:
      https://ai.egain.cloud/system/auth/TMPRODB88619984-C/oauth2/token

Headers:

HeaderValue
Content-Typeapplication/x-www-form-urlencoded

Body Parameters (application/x-www-form-urlencoded):

ParameterRelevanceDescription
grant_typeRequiredMust be set to authorization_code.
codeRequiredThe authorization code received from the previous step.
redirect_uriRequiredThe same redirect_uri used in the initial authorization request.
client_idRequiredThe Client ID for your application.
code_verifierRequiredThe original secret generated by your application before the flow started.
  • Example Full Token cURL for a User:
curl --location --request POST 'https://ai.egain.cloud/system/auth/TMPRODB88619984-U/oauth2/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=authorization_code' \
--data-urlencode 'code=def456-gh-ijkl-789-mnopqr' \
--data-urlencode 'redirect_uri=https://oauth.pstmn.io/v1/callback' \
--data-urlencode 'client_id=b4b2c1d9-4c19-4e8a-8e7a-9a0b1c2d3e4f' \
--data-urlencode 'code_verifier=dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk'

Next Steps:

Auth Code

Client Credentials