Full-flow Example

15700 views June 12, 2017 April 29, 2020 22


Take your client_id and client secret and concatenate them with a colon sign in between (like this -> client_id:client_secret) and base64 encode the result. Put it in a text file.

Build your request string. For example:

Set state to anything.

acr_values define what method to use. As you can see from the example URI, “idin” will be used. To use other methods see Demo service for available methods and modify the value following acr_values with the desired method name.

redirect_uri must be configured for the client and character-for-character exactly the same.

Paste that URI into your browser and complete the flow. You should end up at the redirect URI with two parameters in the URI in the address bar: “code” and “state”. The state should be the one you supplied in the initial request.


Copy the “code” you got and paste it into the following URL request (remember to change client_id and the hostname to the correct one):

curl -XPOST "" -H "Authorization: Basic ZGVtby1wcmVwcm9kOm1xWi1fNzUtZjJ3TnNpUVRPTmI3T240YUFaN3pjMjE4bXJSVmsxb3VmYTg=" -d "client_id=demo-preprod&redirect_uri= GOES HERE"


  • Redirect URI MUST be the same as the initial one.
  • The header, as shown must be “Authorization: Basic THE_BASE64_ENCODED_CREDENTIALS_YOU_MADE_IN_THE_FIRST_STEP”
    • In this case we have base64-encoded “demo-preprod:mqZ-_75-f2wNsiQTONb7On4aAZ7zc218mrRVk1oufa8”
  • Paste the code in the “code” parameter

Now, run that command. You should get JSON containing an access token, a refresh token (depending on the config), and an ID token. Copy the access token string.


It’s time to use the access token to return a JSON containing your information. Run:

curl -XGET "" -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

Was this helpful?