Authorization Code

Overview

The Authorization Code grant type is a 2 part process. The code token must be requested and then exchanged for an access token.

Getting an Auth Code

GET
/oauth/authorize

Request

• client_id (required)– The client ID making the request
• redirect_uri (optional|required) – The URL which to redirect back to. This parameter is required if there is not redirect URI defined in the client settings AND OR if “enforce redirect URI” is set in the plugin settings.
• response_type (required) – Must be set to “code”
• scope (optional) – Space delimited scope
• state (optional) – Client generated CSRF token. This value will be passed back to the client.

Response

• code (string) – The authorization code.
• state (mixed) – If a state parameter were supplied in the request, it would be returned.

Gaining an Access Token

Once you have the authorization code, you must make another request to obtain an access token. The authorization code is only valid for approximately 30 seconds.

Request

POST
oauth/token

• grant_type (required) – Must be “authorization_code”
• code (required) – The code returned from the authorization server
• client_id (required) – The client id
• client_secret (required) – The client secret
• redirect_uri (optional|required) – URL to redirect the user back to
• state (optional|required) – CSRF Token. Required if “enforce state” is enabled.

– FAST CGI and CGI users may experience issues with header authorization. See https://wp-oauth.com/docs/common-issues/header-authorization-may-not-work-as-expected.

Response

The response will be in JSON format

• access_token – The access token
• expires_in – Time the access token expires in seconds from current time
• token_type – Type of token. “Bearer” is only supported
• scope – The scopes authorized for this access token
• refresh_token – The refresh token

{
 "access_token": "aph6jiiwsvgyt9j4fohayegypbo65f8fpjodpdckuiqho0p4wf",
 "expires_in": 3600,
 "token_type": "Bearer",
 "scope": "basic",
 "refresh_token": "g1b4cph2kjnwojzofajvqsfzb2oltjthtermizvlnzsaqjl2o9"
}

Requesting the User Information

GET
oauth/me

• access_token (required) – This must be a valid access token

Response

The response will be in JSON format containing username, email, and other user information regarding the user that authorized the access token.