/bc/authorize

Request

This endpoint returns a unique identifier (auth_req_id) that identifies the authentication flow while it tries to authenticate the user in the background. This auth_req_id value is used in subsequent token requests to the /token endpoint.

Note: The /bc/authorize endpoint requires client authentication. The method is configured per client app. See Client authentication methods.

Bodyapplication/x-www-form-urlencoded

binding_messagestring

A message that appears for the user to identify the transaction

id_token_hintstringrequired

An ID token previously issued to the client as a hint to identify the user for whom authentication is being requested.

Note: You can specify either login_hint or id_token_hint in the authentication request, not both.

login_hintstringrequired

A hint to the OpenID Provider regarding the user for whom authentication is being requested.

Note: You can specify either login_hint or id_token_hint in the authentication request, not both.

requeststring

A JWT created by the client that enables requests to be passed as a single, self-contained parameter.

Note: See Build a JWT for client authentication.

You must sign the JWT using either the app's client secret or a private key whose public key is registered on the app's JWKSet.
You can't encrypt the JWT.
Okta supports the HMAC, RSA and ECDSA signature algorithms. HMAC signatures require the client to have a token_endpoint_auth_method that uses a client_secret. RSA and ECDSA signatures require the client to register a public key.
You must specify backchannel_authentication_request_signing_alg either during client registration or when updating the client to use the signed authentication requests.
Okta validates the request parameter in the following ways:
1. iss is required and must be the client_id.
2. aud is required and must be the same value as the authorization server issuer that mints the ID or access token. This value is published in the metadata for your authorization server.
3. JWT lifetime is evaluated using the iat and exp claims, if present. If the JWT is expired or not yet valid, Okta returns an invalid_request_object error. Okta rejects JWTs that expire more than one hour in the future.
4. Okta rejects the JWT if the jti claim is present and it's already been processed.

requested_expiryinteger, [ 1 .. 300 ]

Allows the client to request the expires_in value in number of seconds for the auth_req_id that the server returns.

scopestringrequired

openid is required for authentication requests. You can also include other scopes.

property name*anyadditional property

POST

/oauth2/v1/bc/authorize

curl -i -X POST \
  https://okta-subdomain.pixtulate.com/oauth2/v1/bc/authorize \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d client_id=0jrabyQWm4B9zVJPbotY \
  -d client_secret=6W7XvLCrs4ByKn7Ucwh8ygeeXRhdGFdVOTp75eOc \
  -d scope=openid \
  -d 'binding_message=Signing in from device' \
  -d login_hint=john.doe@example.com

Responses

Success

Bodyapplication/json

auth_req_idstring

A unique identifier to identify the authentication request made by the client

expires_ininteger, [ 1 .. 300 ]

The expiration time of the auth_req_id in seconds

intervalinteger

The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint

Response

{
  "auth_req_id": "ftJwF5ZwW2SGPPoTQEKtAr_U8_Ek3RvWyR",
  "expires_in": 300,
  "interval": 5
}