Authorization Code + PKCE

Environment and endpoints

Production issuer is https://accounts.appforges.com; staging is https://accounts-staging.appforges.com. Browser authorization uses the issuer's /oauth2/authorize, and token exchange uses /oauth2/token. Business APIs use the matching API domain. Do not use REST /v1/oauth/authorize as a browser login URL.

Create an OAuth client in application Credentials with Public/Confidential mode, redirect URIs and allowed scopes. Copy the actual client_id; app_id is a different identifier. Public clients use PKCE S256 without client_secret; Confidential secrets stay on secure backends.

User authorization steps

1. Generate random state and code_verifier and store them in the login session. Derive code_challenge using SHA256 and unpadded base64url.
2. Redirect the browser to the issuer's /oauth2/authorize with response_type=code, client_id, exactly registered redirect_uri, scope, state, code_challenge and code_challenge_method=S256. Profile access needs user:profile:read.
3. The user signs in and authorizes at accounts. On your callback, check error and validate state before trusting code.
4. POST form-encoded data to the same issuer's /oauth2/token: grant_type=authorization_code, code, client_id, the same redirect_uri and original code_verifier. Confidential clients additionally authenticate as registered; Public clients do not send a secret.
5. Store tokens securely, honor expires_in, then read the profile using quickstart. Codes are single-use. Never log code, token or secret.

Creating an application does not return a user access token. Authorization requires a real user session and permitted client; client_credentials is not a shortcut.