Authorize user apps with and without PKCE

Use this endpoint to authenticate user apps using fabric Identity. When calling this endpoint, the immediate response will be a browser redirect to the hosted Login page configured in fabric Identity. After successful authentication of the user on the hosted Login page, fabric Identity will redirect back to the user app using the provided redirect_uri. This endpoint supports both authorization code flow with and without Proof of Code Exchange (PKCE).
Note: This endpoint isn’t required for system app authentication (refer to /token endpoint instead)

Query Parameters

client_id

string

required

Client ID of the user app

response_type

string

required

Type of the response expected. This should always be set to code (as per OAuth 2.0 grant type, refer to https://datatracker.ietf.org/doc/html/rfc6749#page-19) for additional info.

scope

string

required

Scope of the endpoint call. This should always be set to openid (as per OpenID Connect standard. Refer to https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest for additional info)

redirect_uri

string

required

Redirect URI of the user app is where fabric Identity will redirect the user upon successful login. This URI should be hosted by the user app. As part of the redirect, you will receive the auth code (as code query parameter) which can then be exchanged for the access token (refer to /token).

state

string

required

Random string created by the user app. It's used to maintain state between the request and the callback. The state helps mitigate Cross-Site Request Forgery (CSRF) when it's cryptographically derived from a browser cookie that signifies the user or session.

code_challenge_method

string

Required only when using authorization code flow with PKCE. A code challenge method supported by PKCE specification. fabric Identity only supports the value of S256 (Refer to https://datatracker.ietf.org/doc/html/rfc7636#section-4.2 for additional info). This parameter is mandatory for authorization code flow with PKCE and isn't required for the regular authorization code flow.

code_challenge

string

required

Required only when using authorization code flow with PKCE. The code challenge created by the user app as per the specification on PKCE - https://datatracker.ietf.org/doc/html/rfc7636#section-4.2.