/primary-authenticate

Request

Initiates direct authentication with an out-of-band authenticator

Note: The /primary-authenticate endpoint requires client authentication. The method is configured per client app. See Client authentication methods.

Path

authorizationServerIdstringrequired

id of the authorization server

Bodyapplication/x-www-form-urlencoded

challenge_hintstring(ChallengeHint)required

The type of challenge to prompt for in a /primary-authenticate request

Value:"urn:okta:params:oauth:grant-type:oob"

channel_hintstring(Channel)required

The out-of-band channel for use with authentication. Required for all /primary-authenticate and /challenge requests with an out-of-band authenticator.

Enum:"push""sms""voice"

login_hintstringrequired

The user sign-in information for whom authentication is being requested

POST

/oauth2/{authorizationServerId}/v1/primary-authenticate

curl -i -X POST \
  'https://okta-subdomain.pixtulate.com/oauth2/{authorizationServerId}/v1/primary-authenticate' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d login_hint=testuser@example.com \
  -d channel_hint=push \
  -d challenge_hint=urn:okta:params:oauth:grant-type:oob

Responses

Out-of-band authentication has successfully been initiated.

Bodyapplication/json

binding_codestring

The end-user verification code used to bind the authorization operation on the secondary channel with the primary channel. Present only if binding_method=transfer.

binding_methodstring(BindingMethod)

The method used to bind the out-of-band channel with the primary channel.

Enum:"none""prompt""transfer"

channelstring(Channel)

The out-of-band channel for use with authentication. Required for all /primary-authenticate and /challenge requests with an out-of-band authenticator.

Enum:"push""sms""voice"

expires_ininteger

Number of seconds until the oob_code expires

intervalinteger

The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint

oob_codestring

A unique identifier for identifying the out-of-band transaction across multiple requests

Response

{
  "oob_code": "ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9",
  "channel": "push",
  "binding_method": "none",
  "expires_in": 300,
  "interval": 5
}