(Required)

The ID of the registered application. This is also referred to as APPID.

client_id=GGjeDjEY6kKEiDmX

(Required)

The URI where the access_token value or authorization code value will be delivered upon successful authorization. The URI must match one of the URIs specified during app registration; otherwise, authorization will be rejected. If registered, a special value of urn:ietf:wg:oauth:2.0:oob can also be specified for authorization grants. This will result in the authorization code being delivered to a portal URL (/oauth2/approval). This value is typically used by applications that don't have a web server or a custom URI scheme where the code can be delivered.

redirect_uri=https://app.example.com/cb

(Required)

The type of grant, either implicit (token) or authorization (code).

Values: token | code

response_type=token

The secret of the registered application. This is also referred to as APPSECRET.

client_secret=57e2f75cd56346bf9d5654c3338a1250

The Base64-URL-encoded SHA256 hash of the client-generated code verifier. The code verifier is a cryptographically random string using the characters A-Z, a-z, 0-9, and the punctuation characters -._~ (hyphen, period, underscore, and tilde), between 43 and 128 characters long.

Clients that cannot perform a SHA256 hash can use the plain code verifier string as the code_challenge. Using the plain code verifier provides less security benefits, so use only when necessary.

Example

code_challenge=abcdsasdf34efghabcdsasdf3aaab234asdf3aaartyrtdsasdf3aa

Indicates whether the code_challenge value is SHA256 hash or plain text. The default is plain.

If the value is set to plain, the authorization server will perform an exact match of the code_challenge value and the code challenge verifier. Using plain provides less security benefits, so use only when necessary.

Values: S256 | plain

Specifies the template used to render the login page. Based on the client platform, you can choose one of the supported templates for the app to render the login page. If not specified, the default template is used.

Values: default | iframe | win8

The requested validity, specified in minutes, of the access_token value for implicit grants or refresh_token value for authorization grants. For implicit grants, the default validity of the access_token value is 120 minutes. The expiration parameter, if specified, overrides the validity period up to a maximum of 20,160 minutes (two weeks).

For authorization grants, the default validity of the access_token value is 30 minutes and cannot be increased. The default validity of the refresh_token value is 20,160 minutes (two weeks). The expiration parameter, if specified, overrides the validity period of the refresh_token parameter up to a maximum of 90 days.

expiration=20160

{
    "error": {
        "code": 498,
        "message": "Invalid Token",
        "details": []
    }
}

The locale assumed to render the login page. The user's locale can be passed using this parameter. The login page will be rendered using the language corresponding to that locale. If not specified, the locale is based on the organization's setting or on the incoming request.

locale=fr

An opaque value used by applications to maintain state between authorization requests and responses. The state value, if specified, will be delivered back to the redirect_uri value as is. Use this parameter to correlate the authorization request sent with the received response.

state=qyxmpg9e5uWUPbxw

Specifies, the color scheme used to render the login page regardless of browser or operating system settings. If not specified, the style will follow the browser or OS color scheme if designated. The light option is the default style when there is no designation.

Values: light | dark