Authentication by Login Callback
Open this endpoint in a browser to let the user sign in and authorize access. An access token is not required for this authorization entry point.
| Property | Value |
|---|---|
| Method | GET |
| Path | /api/authorize.do |
URL Parameters
| Parameter | Type | Description |
|---|---|---|
response_type |
string | Required; code |
client_id |
string | Required; developer application ID |
redirect_uri |
string | Required; must match the registered callback; URL-encode this parameter |
data |
string | Optional data returned with the callback; do not include secrets |
Scroll horizontally to view all columns
Flow
- Open the authorization URL with the required parameters.
- Users sign in if needed and grant authorization.
- The server redirects to
redirect_uriwith HTTP 302, carryingcodeanddata. - Your server exchanges the code using Get Token.
A code is valid for five minutes and becomes invalid after one use, including an unsuccessful exchange. Validate the callback against the originating session; a one-time random value in data can correlate the request. Use HTTPS and do not log complete authorization codes.
JWT authorization is a separate flow. Do not mix its parameters with this flow.