/
Authorization Code Flow

Authorization Code Flow

Owned by Yashna Chhatwal (Unlicensed)
May 07, 2020
2 min read

 

  1. The user clicks Install from Workspace(Client Portal) and is redirected to APP’s Url to get Authorize parameters.

  2. APP redirects to Eshopbox Authorization server.

  3. Eshopbox Authorization server validates accountSlug, clientId and redirectUri from APP’s request.

    1. Generate systemState using accountSlug i.e {{accountSlug}}_timestamp

    2. Save accountSlug, clientId, redirectUri, scope, state ,systemState and status(Pending) in DB

  4. Eshopbox authorization server redirects the user to the Auth0 Authorization Server(/authorize endpoint).

  5. Auth0 Authorization Server redirects the user to the login and authorization prompt.

  6. The user authenticates using one of the configured login options and may see a consent page listing the permissions Auth0 will give to the regular web application.

  7. Auth0 Authorization Server redirects the user back to the Eshopbox Authorization server with an authorization code and state.

  8. Auth0 Authorization Server checks if state is same as systemState and status is pending

    1. Check if accountSlug extracted from state and appId exists then update status to installed else create a new record in DB.

  9. Eshopbox authorization server redirects the user back to APP with an authorization code .

  10. APP sends this code to the Auth0 Authorization Server (/oauth/token endpoint) along with the application's Client ID and Client Secret.

  11. Auth0 Authorization Server verifies the code, Client ID, and Client Secret.

  12. Your Auth0 Authorization Server responds with an ID Token and Access Token (and optionally, a Refresh Token).

Related content