# OAUTH 2.0 information

The Signicat identity broker supports the most commonly used OAUTH 2.0 flows: Authorisation Code Grant and Grant.

# Authorisation Code grant flow

The Authorisation Code grant type is used by clients to exchange an authorisation code for an access token. See https://oauth.net/2/grant-types/authorization-code/ (opens new window) for a detailed description of the flow.\

Example of authorisation request

<base_url>/authorize?client_id=<client_id>&redirect_uri=<redirect_uri>&response_type=code&scope=<scope>
ID Value Description
client_id Unique identifier Identifies the client at the Signicat Identity Broker. This must be agreed upon between your service and Signicat before starting the integration.
redirect_uri URL The URL on your service that will receive the response.
response_type "code" This value must be set to "code" to retrieve an Authorisation Token.
scope Optional field Via some OAuth servers, the client can specify the scope of the request.

Example of authorisation response

<redirect_uri>?code=<authorization_token>

Before the <authorisation_token> is sent, the user must first authenticate themselves via an identity provider.

# Example messages for Access Token endpoint

Access Token request (POST method)

<base_url>/access_token?client_id=<client_id>&client_secret=<client_secret>&grant_type=authorization_code&code=<code>&redirect_uri=<redirect_uri>

The parameters should be send in the request body with Content-Type header: application/x-www-form-urlencoded.

ID Value Description
client_id Unique identifier Identifies the client at the Signicat Identity Broker. This must be agreed upon between your service and Signicat before starting the integration.
redirect_uri URL The URL on your service that will receive the response.
grant_type "authorisation_code" Must be set to this value to receive an Access Token.
client_secret Unique identifier A secret key agreed upon between your service and the Signicat Identity Broker.
code Unique identifier This is the Authorisation Token returned by the Signicat Identity Broker from the authorisation endpoint.

Access Token response (JSON format)

{
  "access_token":"<access_token>",
  "token_type":"bearer",
  "expires_in":3600,
  "refresh_token":"<refresh_token>",
}

ID Value Description
access_token Unique identifier The Access Token returned by the Signicat Identity Broker.
token_type "Bearer"
expires_in Integer Defines the time (in seconds) when the Access Token will expire.
refresh_token Unique identifier The Refresh Token returned by the Signicat Identity Broker.

# Example messages for user info endpoint

User info request (GET method)

<base_url>/<access_token>

User Info response (JSON format)

{ "nameId": "<some_name>",
    "userAttributes" :
    [
        "name": ["<attribute_value1>", <attribute_value2>, ...],
    ]
}

# Implicit grant flow

This flow can be used by applications running in the browser that cannot securely store a shared secret. In this case, the access token is directly returned upon user authentication and authorisation.

See https://oauth.net/2/grant-types/implicit/ (opens new window) for a detailed description of the flow.

# Example messages for Authorisation endpoint

Authorisation request

<base_url>/authorize?client_id=<client_id>&redirect_uri=<redirect_uri>&response_type=token&scope=<scope>&state=<state>
ID Value Description
client_id Unique identifier Identifies the client at the Signicat Identity Broker. This must be agreed upon between your service and Signicat before starting the integration.
redirect_uri URL The URL on your application that will receive the response.
response_type "Token" This value must be set to "token" to retrieve an Access Token.
scope Optional field At some OAuth servers, the client can specify the scope of the request.
state

Recommended unique identifier

An opaque value used by the client to prevent cross-site request forgery.

Authorisation response

<redirect_uri>?code=<access_token>&state=<state>&token_type=bearer&expires_in=<expires_in>
ID Value Description
access_token Unique identifier The Access Token returned by the Signicat identity broker.
state Unique identifier The same value as sent in the request.
token_type “Bearer”
expires_in Integer

Defines the time (usually in seconds) when the Access Token will expire.

Last updated: 6/22/23, 9:00:44 AM UTC