BUILD

Authorization Code flow

Exchange a short-lived authorization code for tokens after interactive consent.

Endpoints

POST /oauth/authorize
POST /oauth/token

Parameter	Requirement
client_id	Registered application client ID.
redirect_uri	Must exactly match a registered URI.
response_type	Authorization code flow.
scope	Only supported API/OIDC scopes.
state	Client-generated CSRF correlation value.
code_challenge	PKCE challenge.
code_challenge_method	S256.

The code is single-use and bound to the client, redirect URI, user consent, and PKCE verifier. Treat returned access and refresh tokens as bearer secrets.