Skip to main content

​
Authorization Code Flow with PKCE (User Authorization)

The Authorization Code Flow with PKCE (Proof Key for Code Exchange) is recommended for mobile and public clients, as it provides an additional security layer to prevent authorization code interception attacks.

​
📤 Step 1: Authorization Request

The client redirects the user to the following URL to start the authorization process: Example URL (decoded for readability): 
[GET] https://logintest.clearline.me/Account/Login
        ?ReturnUrl=/connect/authorize/callback
        &response_type=code
        &client_id=clover-cmc-mobile
        &scope=clearline_api
        &redirect_uri=clover://auth-callback
        &code_challenge=OrvUYB26YPnibHWrgRjENwe_9n_6HUFeqzEgrGP9HK4
        &code_challenge_method=S256
ℹ️ This URL is typically constructed and handled by your mobile app or frontend SDK.

​
🔐 Parameters Explained

ParameterDescription
response_type=codeSpecifies that you are requesting an authorization code
client_idThe public identifier of the mobile app (no secret required)
scopeThe API scopes requested (e.g., clearline_api)
redirect_uriThe URI where the code will be sent back (e.g., clover://auth-callback)
code_challengeA hashed value derived from a random string (code_verifier)
code_challenge_methodThe method used to hash the verifier — should be S256

​
🔁 PKCE Flow Summary

  1. Generate a Code Verifier
    A high-entropy random string (e.g., 43–128 chars).
  2. Generate a Code Challenge
    code_challenge = BASE64URL(SHA256(code_verifier))
  3. Redirect User to Login URL
    Include code_challenge and code_challenge_method=S256.
  4. User Logs In
    Upon success, they’re redirected to your redirect_uri with a code.
  5. Exchange Code for Token

​
Step 2: Token Exchange (with Basic Auth)

Once you receive the code at your redirect_uri, make the following request to get the access token: POST https://logintest.clearline.me/connect/token

​
🔸 Headers

HeaderValue
AuthorizationBasic {Base64(client_id:client_secret)}
Content-Typeapplication/x-www-form-urlencoded
Example:
Authorization: Basic Y2xvdmVyLWNtYy1tb2JpbGU6Y2xpZW50U2VjcmV0IQ==

​
🔸 Body

grant_type=authorization_code
&code={authorization_code}
&redirect_uri=clover://auth-callback
&code_verifier={original_code_verifier}

​
✅ Example Response

{
  "access_token": "eyJhbGciOiJIUzI1NiIs...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "df8a2f3e...",
  "scope": "clearline_api"
}