> ## Documentation Index
> Fetch the complete documentation index at: https://docs.clearline.me/llms.txt
> Use this file to discover all available pages before exploring further.

# Authorization Code Flow with PKCE (User Authorization)

## Authorization Code Flow with PKCE (User Authorization)

The **Authorization Code Flow with PKCE (Proof Key for Code Exchange)** is recommended for **mobile and public clients**, as it provides an additional security layer to prevent authorization code interception attacks.

***

### 📤 Step 1: Authorization Request

The client redirects the user to the following URL to start the authorization process:

**Example URL (decoded for readability):**

```
[GET] https://logintest.clearline.me/Account/Login
        ?ReturnUrl=/connect/authorize/callback
        &response_type=code
        &client_id=clover-cmc-mobile
        &scope=clearline_api
        &redirect_uri=clover://auth-callback
        &code_challenge=OrvUYB26YPnibHWrgRjENwe_9n_6HUFeqzEgrGP9HK4
        &code_challenge_method=S256
```

ℹ️ This URL is typically constructed and handled by your mobile app or frontend SDK.

***

### 🔐 Parameters Explained

| Parameter               | Description                                                             |
| ----------------------- | ----------------------------------------------------------------------- |
| response\_type=code     | Specifies that you are requesting an authorization code                 |
| client\_id              | The public identifier of the mobile app (no secret required)            |
| scope                   | The API scopes requested (e.g., clearline\_api)                         |
| redirect\_uri           | The URI where the code will be sent back (e.g., clover://auth-callback) |
| code\_challenge         | A hashed value derived from a random string (code\_verifier)            |
| code\_challenge\_method | The method used to hash the verifier — should be S256                   |

***

### 🔁 PKCE Flow Summary

1. **Generate a Code Verifier**<br />
   A high-entropy random string (e.g., 43–128 chars).
2. **Generate a Code Challenge**<br />
   `code_challenge = BASE64URL(SHA256(code_verifier))`
3. **Redirect User to Login URL**<br />
   Include `code_challenge` and `code_challenge_method=S256`.
4. **User Logs In**<br />
   Upon success, they’re redirected to your `redirect_uri` with a `code`.
5. **Exchange Code for Token**

## Step 2: Token Exchange (with Basic Auth)

Once you receive the `code` at your `redirect_uri`, make the following request to get the access token:

**POST** `https://logintest.clearline.me/connect/token`

### 🔸 Headers

| Header          | Value                                     |
| --------------- | ----------------------------------------- |
| `Authorization` | `Basic {Base64(client_id:client_secret)}` |
| `Content-Type`  | `application/x-www-form-urlencoded`       |

Example:<br />
`Authorization: Basic Y2xvdmVyLWNtYy1tb2JpbGU6Y2xpZW50U2VjcmV0IQ==`

### 🔸 Body

```
grant_type=authorization_code
&code={authorization_code}
&redirect_uri=clover://auth-callback
&code_verifier={original_code_verifier}
```

***

## ✅ Example Response

```json theme={null}
{
  "access_token": "eyJhbGciOiJIUzI1NiIs...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "df8a2f3e...",
  "scope": "clearline_api"
}
```