Authorization Code Flow with PKCE (User Authorization)

The Authorization Code Flow with PKCE (Proof Key for Code Exchange) is recommended for mobile and public clients, as it provides an additional security layer to prevent authorization code interception attacks.

📤 Step 1: Authorization Request

The client redirects the user to the following URL to start the authorization process: Example URL (decoded for readability):

[GET] https://logintest.clearline.me/Account/Login
        ?ReturnUrl=/connect/authorize/callback
        &response_type=code
        &client_id=clover-cmc-mobile
        &scope=clearline_api
        &redirect_uri=clover://auth-callback
        &code_challenge=OrvUYB26YPnibHWrgRjENwe_9n_6HUFeqzEgrGP9HK4
        &code_challenge_method=S256

ℹ️ This URL is typically constructed and handled by your mobile app or frontend SDK.

🔐 Parameters Explained

Parameter	Description
response_type=code	Specifies that you are requesting an authorization code
client_id	The public identifier of the mobile app (no secret required)
scope	The API scopes requested (e.g., clearline_api)
redirect_uri	The URI where the code will be sent back (e.g., clover://auth-callback)
code_challenge	A hashed value derived from a random string (code_verifier)
code_challenge_method	The method used to hash the verifier — should be S256

🔁 PKCE Flow Summary

Generate a Code Verifier
A high-entropy random string (e.g., 43–128 chars).
Generate a Code Challenge
code_challenge = BASE64URL(SHA256(code_verifier))
Redirect User to Login URL
Include code_challenge and code_challenge_method=S256.
User Logs In
Upon success, they’re redirected to your redirect_uri with a code.
Exchange Code for Token

Step 2: Token Exchange (with Basic Auth)

Once you receive the code at your redirect_uri, make the following request to get the access token: POST https://logintest.clearline.me/connect/token

🔸 Headers

Header	Value
`Authorization`	`Basic {Base64(client_id:client_secret)}`
`Content-Type`	`application/x-www-form-urlencoded`

Example:
Authorization: Basic Y2xvdmVyLWNtYy1tb2JpbGU6Y2xpZW50U2VjcmV0IQ==

🔸 Body

grant_type=authorization_code
&code={authorization_code}
&redirect_uri=clover://auth-callback
&code_verifier={original_code_verifier}

✅ Example Response

{
  "access_token": "eyJhbGciOiJIUzI1NiIs...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "df8a2f3e...",
  "scope": "clearline_api"
}

Getting Started

Integration Options

POS Integration

API Reference

Authorization Code Flow with PKCE (User Authorization)