> ## Documentation Index
> Fetch the complete documentation index at: https://docs.clearline.me/llms.txt
> Use this file to discover all available pages before exploring further.

# User Login - Authorization Code Flow with PKCE

> Initiates the OAuth2 Authorization Code flow with PKCE for user authentication.
This endpoint is used for **mobile and public clients** that require user consent.

**PKCE Flow:**
1. Generate a high-entropy random `code_verifier` (43-128 characters)
2. Generate `code_challenge = BASE64URL(SHA256(code_verifier))`
3. Redirect user to this endpoint with parameters below
4. User authenticates via the login page
5. Upon success, user is redirected to `redirect_uri` with authorization `code`
6. Exchange code for token at `/connect/token` using the original `code_verifier`

**Security:** PKCE prevents authorization code interception attacks by requiring the original code_verifier during token exchange.




## OpenAPI

````yaml /authentication.openapi.yaml get /Account/Login
openapi: 3.0.1
info:
  title: ClearLine Authentication API
  description: >-
    OAuth2 authentication endpoints for ClearLine Marketing Platform. Supports
    both Client Credentials flow (for POS server-to-server) and Authorization
    Code flow with PKCE (for user authentication).
  version: v1
servers:
  - url: https://logintest.clearline.me
    description: Test Environment - Identity Server
  - url: https://logindemo.clearline.me
    description: Demo Environment - Identity Server
  - url: https://login.clearline.me
    description: Production Environment - Identity Server
security: []
paths:
  /Account/Login:
    get:
      tags:
        - Authentication
      summary: User Login - Authorization Code Flow with PKCE
      description: >
        Initiates the OAuth2 Authorization Code flow with PKCE for user
        authentication.

        This endpoint is used for **mobile and public clients** that require
        user consent.


        **PKCE Flow:**

        1. Generate a high-entropy random `code_verifier` (43-128 characters)

        2. Generate `code_challenge = BASE64URL(SHA256(code_verifier))`

        3. Redirect user to this endpoint with parameters below

        4. User authenticates via the login page

        5. Upon success, user is redirected to `redirect_uri` with authorization
        `code`

        6. Exchange code for token at `/connect/token` using the original
        `code_verifier`


        **Security:** PKCE prevents authorization code interception attacks by
        requiring the original code_verifier during token exchange.
      operationId: OAuth2_AuthorizeLogin
      parameters:
        - name: ReturnUrl
          in: query
          required: true
          description: The OAuth callback URL (typically /connect/authorize/callback)
          schema:
            type: string
          example: /connect/authorize/callback
        - name: response_type
          in: query
          required: true
          description: Must be "code" for authorization code flow
          schema:
            type: string
            enum:
              - code
          example: code
        - name: client_id
          in: query
          required: true
          description: The client identifier for your mobile app (e.g., clover-cmc-mobile)
          schema:
            type: string
          example: clover-cmc-mobile
        - name: scope
          in: query
          required: true
          description: The API scopes requested (e.g., clearline_api)
          schema:
            type: string
          example: clearline_api
        - name: redirect_uri
          in: query
          required: true
          description: >-
            The URI where the authorization code will be sent (e.g.,
            clover://auth-callback)
          schema:
            type: string
          example: clover://auth-callback
        - name: code_challenge
          in: query
          required: true
          description: >-
            BASE64URL(SHA256(code_verifier)) - A hashed value derived from your
            random code_verifier
          schema:
            type: string
          example: OrvUYB26YPnibHWrgRjENwe_9n_6HUFeqzEgrGP9HK4
        - name: code_challenge_method
          in: query
          required: true
          description: The hashing method used for code_challenge - must be "S256"
          schema:
            type: string
            enum:
              - S256
          example: S256
      responses:
        '302':
          description: Redirect to login page or callback URI with authorization code
          headers:
            Location:
              description: Redirect location (login page or redirect_uri with code)
              schema:
                type: string
        '400':
          description: Bad request - invalid parameters
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  schemas:
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
          description: Error code (e.g., invalid_grant, invalid_client, invalid_request)
          example: invalid_grant
        error_description:
          type: string
          description: Human-readable error description
          example: The authorization code is invalid or expired

````