Docs 3689 auth explorer update #10394

avanscoy · 2024-03-28T19:40:40Z

No description provided.

HRI addition

HRI update Break out client grants #Learn More standardization Error pages into Markdown tables

Clean-up Final markdown tables addition of fapi to glossary for HRI entry

Duplicate Learn More

Fixes for the nav, flow files, updated error codes

articles/api/authentication/index.md

Co-authored-by: Patrick Dillon <pdillon@users.noreply.github.com>

edgarchirivella-okta

Great work on this!!

edgarchirivella-okta · 2024-04-26T11:03:25Z

.markdownlint.json

@@ -1,20 +1,20 @@
 {
  "default": false,
  "resultVersion": 1,
-  "MD001": true,
+  "MD001": false,


Do we want to keep these disabled globally instead of using  in the affected files?

For Authentication API Explorer, yes. The errors I'm getting are because the tech is old and we don't have the resources or people to yet to update the experience completely. Once the Explorer is merged, I plan to go back and update this file ^

I understand! Let's keep it like this, then

edgarchirivella-okta · 2024-04-26T11:05:06Z

articles/api/authentication/_introduction.md

@@ -2,7 +2,7 @@

 The Authentication API enables you to manage all aspects of user identity when you use Auth0. It offers endpoints so your users can log in, sign up, log out, access APIs, and more. 

-The API supports various identity protocols, like <dfn data-key="openid">[OpenID Connect](/protocols/oidc)</dfn>, [OAuth 2.0](/protocols/oauth2), and <dfn data-key="security-assertion-markup-language">[SAML](/protocols/saml)</dfn>.
+The API supports various identity protocols, like <dfn data-key="openid">[OpenID Connect](/protocols/oidc)</dfn>, <dfn data-key="oath2"> [OAuth 2.0](/protocols/oauth2)</dfn>, <dfn data-key="fapi">[FAPI](https://auth0.com/docs/secure/highly-regulated-identity#advanced-security-with-openid-connect-fapi-)</dfn> and <dfn data-key="security-assertion-markup-language">[SAML](/protocols/saml)</dfn>.


Do we need the entire URL here instead of just the relative path, as in the other places?

Thank-you for catching this one ^

edgarchirivella-okta · 2024-04-26T11:09:21Z

articles/api/authentication/_passwordless.md

@@ -208,22 +208,11 @@ Once you have a verification code, use this endpoint to login the user with thei
 | <dfn data-key="scope">`scope`</dfn> | Use `openid` to get an ID Token, or `openid profile email` to also include user profile information in the ID Token. |
 | `redirect_uri` <br/><span class="label label-danger">Required</span> | A callback URL that has been registered with your application's **Allowed Callback URLs**. |

-
-### Test with Authentication API Debugger


It's great to see references to the Authentication API Debugger removed 🙂

Yes! I haven't heard if the Debugger has been fully deprecated or not, so I have a single reference in the intro for it.

It's not fully deprecated. There is an intention to deprecate it, but not a plan AFAIK.
What you did looks perfect to me: maintaining a reference to it but reducing the doc coverage to discourage new people from using it.

edgarchirivella-okta · 2024-04-26T11:14:42Z

articles/api/authentication/api-authz/_auth-code-pkce.md

+```
+
+```javascript
+var request = require("request");


This is a bit nitpicky, I'd love to have const instead of var in the code examples. I think that var could transmit the image of being out of fashion, or not up-to-date with the current best practices, which may put off some people.

var is perfectly functional in any case, so this is totally optional, but using const would transmit a more "modern" feel.

@edgarchirivella-okta , these code samples weren't updated this round. Would I just replace var with const?

No problem! I understand that you just moved the code examples between files.

I don't think it's required now, this is something that could be included in the future project you have next quarter, if you have the time to include it 🙂

In these small examples, it would just be replacing var with const. There are some gotchas because they don't behave in the exact same way, but for these examples, replacing var with const would do. This is a very good explanation of the differences: https://www.freecodecamp.org/news/var-let-and-const-whats-the-difference/

In general, people try to use const first, and let only if the variable needs to be reassigned. var is only seen in older projects nowadays.

Sounds perfect! I was talking to Daniel and David about the next project including a closer review of the flows and samples!

edgarchirivella-okta · 2024-04-26T11:17:45Z

articles/api/authentication/api-authz/_auth-code-pkce.md

+    code: "AUTHORIZATION_CODE",
+    redirect_uri: "${account.callback}", } };
+
+request(options, function (error, response, body) {


And related to the var comment above, I think that converting these examples to async/await could make us more approachable, because the devs learning Node and Javascript these days may not even be familiar with callbacks.

This has lower priority than the var comment above and I understand the pressure to merge this today, so this is just a suggestion for a future improvement.

I have another larger project for the Explorer planned for next quarter, so this could absolutely be helpful!

That sounds great! Thank you for that 😄 let's keep it with the callbacks here, then

edgarchirivella-okta · 2024-04-26T11:20:57Z

articles/api/authentication/api-authz/_refresh-token.md

+> RESPONSE SAMPLE:
+
+```JSON
+HTTP/1.1 200 OK


Should we remove the HTTP/1.1 line here too?

I checked with Session since these samples are very old. For this fragment, leaving the HTTP could help with error handling, so for this project, we'll leave them. Next quarter, I'll engage engineering to review the samples more closely.

dlozlla · 2024-04-26T11:55:42Z

articles/api/authentication/api-authz/_highly-regulated.md

+```http
+POST ${account.namespace}/oauth/par
+Content-Type: 'application/x-www-form-urlencoded'
+  response_type=code|code id_token&


It is important that all example include

an audience param (optional)

an authorization_details param (optional)

Pending updates on Google doc

dlozlla · 2024-04-26T11:55:52Z

articles/api/authentication/api-authz/_highly-regulated.md

+  url: 'https://{yourDomain}/oauth/par,
+  headers: { 'content-type': 'application/x-www-form-urlencoded' },
+  form: { 
+    response_type: 'code|code id_token',


It is important that all example include

an audience param (optional)

an authorization_details param (optional)

Pending updates on Google doc

dlozlla · 2024-04-26T11:56:12Z

articles/api/authentication/api-authz/_highly-regulated.md

+curl --request POST \
+  --url 'https://{yourDomain}/oauth/par' \
+  --header 'content-type: application/x-www-form-urlencoded' \
+--data 'response_type=code|code id_token& client_id={yourClientId}& redirect_uri={https://yourApp/callback}&state=STATE&scope=openid|profile|email&code_challenge=CODE_CHALLENGE&code_challenge_method=S256&nonce=NONCE&connection=CONNECTION&prompt=login|consent|none&organisation=ORGANIZATION'


It is important that all example include

an audience param (optional)

an authorization_details param (optional)

Pending updates on Google doc

dlozlla · 2024-04-26T11:57:06Z

articles/api/authentication/api-authz/_highly-regulated.md

+::: note
+Highly Regulated Identity is currently available for Enterprise customers under Limited Early Access. To learn more about this program, contact [Auth0 Support](http://support.auth0.com/). 
+:::
+Push Authorization Requests (PAR), a service of [Highly Regulated Identity](https://auth0.com/docs/secure/highly-regulated-identity), uses the `/oauth/par` endpoint to allow applications to send the authentication parameters usually sent in a `GET` request to `/authorize`. PAR uses a POST method from the backend to keep parameter values secure. The /oauth/par endpoint accepts all standard authorization parameters similar to /authorize. Assuming the call to the /oauth/par endpoint is valid, Auth0 will respond with a redirect_uri value that can be used as a parameter for the /authorize endpoint.


Suggested change

Push Authorization Requests (PAR), a service of [Highly Regulated Identity](https://auth0.com/docs/secure/highly-regulated-identity), uses the `/oauth/par` endpoint to allow applications to send the authentication parameters usually sent in a `GET` request to `/authorize`. PAR uses a POST method from the backend to keep parameter values secure. The /oauth/par endpoint accepts all standard authorization parameters similar to /authorize. Assuming the call to the /oauth/par endpoint is valid, Auth0 will respond with a redirect_uri value that can be used as a parameter for the /authorize endpoint.

Push Authorization Requests (PAR), a service of [Highly Regulated Identity](https://auth0.com/docs/secure/highly-regulated-identity), uses the `/oauth/par` endpoint to allow applications to send the authorization parameters usually sent in a `GET` request to `/authorize`. PAR uses a POST method from the backend to keep parameter values secure. The /oauth/par endpoint accepts all standard authorization parameters similar to /authorize. Assuming the call to the /oauth/par endpoint is valid, Auth0 will respond with a redirect_uri value that can be used as a parameter for the /authorize endpoint.

Added to the next commit

dlozlla · 2024-04-26T11:57:45Z

articles/api/authentication/api-authz/_highly-regulated.md

+## Request Parameters
+| Parameter        | Description |
+|:-----------------|:------------|
+| `response_type` <br/><span class="label label-danger">Required</span> | Specifies the token type. We recommend you use code to request an authorization code, or code id_token to receive an authorization code and a [detached signature](https://openid.net/specs/openid-financial-api-part-2-1_0.html#id-token-as-detached-signature). |


Add

audience
The unique identifier of the target API you want to access.

dlozlla · 2024-04-26T11:58:14Z

articles/api/authentication/api-authz/_highly-regulated.md

+| `redirect_uri` <br/><span class="label label-danger">Required</span> | The URL to which Auth0 will redirect the browser after authorization has been granted by the user. Specify the `redirect_uri` under your [Application's Settings](${manage_url}/#/applications).|
+| `state` <br/><span class="label label-primary">Recommended</span> | An opaque value the applications adds to the initial request that the authorization server includes when redirecting the back to the application. This value must be used by the application to prevent CSRF attacks. |
+| `scope` <br/><span class="label label-primary">Recommended</span>| OIDC scopes and custom API scopes. For example: `openid read:timesheets`. Include `offline_access` to get a Refresh Token.|
+| `code_challenge` <br/><span class="label label-primary">Recommended</span> | OIDC scopes and custom API scopes. For example: `openid read:timesheets`. Include offline_access to get a Refresh Token. |


Add

authorization_details
Similarly to scopes, this parameter allows you to request specific permissions for each resource you want to access. In this case, you can specify an array of json objects to convey fine-grained information on the authorization. Each json object must contain a type attribute and the rest is up to you to define. Read the [RAR reference documention](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow/authorization-code-flow-with-rar) to learn all the details.

I edited this description on the Google Doc and added the example case to the Remarks sections

dlozlla · 2024-04-26T11:59:51Z

articles/api/authentication/api-authz/_highly-regulated.md

+> RESPONSE SAMPLE:
+``` json
+/**
+The `/oauth/token` endpoint will respond with a JSON object containing an `id_token` property, and potentially also a `refresh_token` if one was requested.


Suggested change

The `/oauth/token` endpoint will respond with a JSON object containing an `id_token` property, and potentially also a `refresh_token` if one was requested.

The `/oauth/token` endpoint will respond with a JSON object containing an `access_token` property, and potentially also a `refresh_token` if one was requested. If you specified the authorization_details parameter at the beginning of the flow, it will also be added to the response to indicate the details of what has been authorized.

I don't know if this text should appear here in the json example or be included as part of the remarks

This line was originally associated with the Response, so I put it as commented out. Feel free to update it on the Google doc and I can update.

dlozlla · 2024-04-26T12:00:21Z

articles/api/authentication/api-authz/_highly-regulated.md

+Content-Type: application/json
+{
+  "refresh_token":"GEbRxBN...edjnXbL",
+  "id_token":"eyJ0XAi...4faeEoQ",


add

"access_token":"eybRxBN...edjnXZQ",

dlozlla · 2024-04-26T12:00:39Z

articles/api/authentication/api-authz/_highly-regulated.md

+{
+  "refresh_token":"GEbRxBN...edjnXbL",
+  "id_token":"eyJ0XAi...4faeEoQ",
+  "token_type":"Bearer",


add

"authrorization_details":[
{
"type":"my_type",
"other_attributes_of_my_type":"value"
}
],

dlozlla · 2024-04-26T12:02:52Z

articles/api/authentication/api-authz/_highly-regulated.md

+  "link": "#exchange-an-authorization-code-for-a-token"
+}) %>
+
+```http


THIS IS INCORRECT. It should be a request to /token.

Okay, if you're talking about the ```http section, I'll need that sample from the team. If this is about the include ^ that's actually the link to the endpoint.

dlozlla · 2024-04-26T12:03:04Z

articles/api/authentication/api-authz/_highly-regulated.md

+```
+
+```javascript
+curl --request POST \


THIS IS INCORRECT. It should be a request to /token.

Okay. Please add the correct sample to the Google doc and I'll get it from there.

dlozlla · 2024-04-26T12:03:39Z

articles/api/authentication/api-authz/_highly-regulated.md

+```
+
+```shell
+var request = require("request");


This request is correct, but shouldn't we add it before the response?

Honestly, it doesn't matter. It's going to show in the correct spot in the Explorer. I'll move it in the next commit.

dlozlla · 2024-04-26T12:08:53Z

articles/api/authentication/api-authz/_highly-regulated.md

+});
+```
+
+When users are redirected to `/authorize`, you need to make a `POST` call to the `oauth/token` endpoint to exchange an authorization code for an access and/or an ID token.


Suggested change

When users are redirected to `/authorize`, you need to make a `POST` call to the `oauth/token` endpoint to exchange an authorization code for an access and/or an ID token.

When users are redirected back to your callback, you need to make a `POST` call to the `oauth/token` endpoint to exchange an authorization code for an access and/or an ID token.

lrzhou25

Nice work, Amanda! This was a behemoth of a project, and all the updates you did will greatly improve doc readability and discoverability.

lmk if you have any questions about my comments!

lrzhou25 · 2024-04-25T19:07:35Z

articles/api/authentication/_introduction.md

@@ -2,7 +2,7 @@

 The Authentication API enables you to manage all aspects of user identity when you use Auth0. It offers endpoints so your users can log in, sign up, log out, access APIs, and more. 

-The API supports various identity protocols, like <dfn data-key="openid">[OpenID Connect](/protocols/oidc)</dfn>, [OAuth 2.0](/protocols/oauth2), and <dfn data-key="security-assertion-markup-language">[SAML](/protocols/saml)</dfn>.
+The API supports various identity protocols, like <dfn data-key="openid">[OpenID Connect](/protocols/oidc)</dfn>, <dfn data-key="oath2"> [OAuth 2.0](/protocols/oauth2)</dfn>, <dfn data-key="fapi">[FAPI](https://auth0.com/docs/secure/highly-regulated-identity#advanced-security-with-openid-connect-fapi-)</dfn> and <dfn data-key="security-assertion-markup-language">[SAML](/protocols/saml)</dfn>.


small nitpick: you could shorten FAPI link by removing "https://auth0.com/docs" from "/secure/highly-regulated-identity#advanced-security-with-openid-connect-fapi-"

lrzhou25 · 2024-04-25T19:09:32Z

articles/api/authentication/_introduction.md

+
+1. At the *OAuth2 / OIDC* tab, click **OAuth2 / OIDC Login**.
+
+### Use Authentication API Debuggar


"Use Authentication API Debuggar"-->"Use Authentication API Debugger"

lrzhou25 · 2024-04-25T19:15:54Z

articles/api/authentication/_introduction.md

+- Legacy Delegation: At the *OAuth2 / OIDC* tab, set **Username** and **Password**. Click **Resource Owner Endpoint**.
+- Legacy Resource Owner:  At the *OAuth2 / OIDC* tab, set the **Username** and **Password**, and click **Resource Owner Endpoint**.
+
+### Use Authentication API Debuggar with authentications flows


should Authentications Flows be capitalized?

lrzhou25 · 2024-04-25T19:17:58Z

articles/api/authentication/_login.md

 - [Custom Social Connections](/connections/social/oauth2)
- [State Parameter](/protocols/oauth2/oauth-state)
+- [State Parameter](https://auth0.com/docs/secure/attack-protection/state-parameters)


the link could be shortened to "/docs/secure/attack-protection/state-parameters"

Got it! I missed this one :D

lrzhou25 · 2024-04-25T19:24:48Z

articles/api/authentication/api-authz/_auth-code-flow.md

+| `client_id` <br/><span class="label label-danger">Required</span> | Your application's Client ID. |
+| `client_secret` <br/><span class="label label-danger">Required</span> | Your application's Client Secret. |
+| `code` <br/><span class="label label-danger">Required</span> | The Authorization Code received from the initial `/authorize` call. |
+| `redirect_uri`| This is required only if it was set at the [GET /authorize](#authorization-code-grant) endpoint. The values must match. |


which values must match?

Ah okay. If you set the redirect_uri at /authorize, the same redirect_uri must be set at /oauth/token. I'll clarify that. Thanks!

lrzhou25 · 2024-04-26T17:55:49Z

articles/api/authentication/api-authz/_resource-owner.md

+| `username` <br/><span class="label label-danger">Required</span> | The user's username |
+| `password` <br/><span class="label label-danger">Required</span> | The user's password |
+| <dfn data-key="scope">`scope`</dfn> | Use `openid` to get an ID Token, `openid profile email` to get an ID Token and the user profile, or `openid offline_access` to get an ID Token and a <dfn data-key="refresh-token">Refresh Token</dfn>. |
+| `id_token` | Used to authenticate using a token instead of username/password, in [Touch ID](/libraries/lock-ios/touchid-authentication) scenarios. |


using a token->with a token
no comma between username/password and in Touch ID

lrzhou25 · 2024-04-26T17:56:29Z

articles/api/authentication/api-authz/_resource-owner.md

+| `password` <br/><span class="label label-danger">Required</span> | The user's password |
+| <dfn data-key="scope">`scope`</dfn> | Use `openid` to get an ID Token, `openid profile email` to get an ID Token and the user profile, or `openid offline_access` to get an ID Token and a <dfn data-key="refresh-token">Refresh Token</dfn>. |
+| `id_token` | Used to authenticate using a token instead of username/password, in [Touch ID](/libraries/lock-ios/touchid-authentication) scenarios. |
+| `device` | You should set this to a string, if you are requesting a Refresh Token (`scope=offline_access`). |


you should set->Set
capitalization of Refresh Token

lrzhou25 · 2024-04-26T17:56:51Z

articles/api/authentication/api-authz/_resource-owner.md

+
+- This endpoint only works for database connections, <dfn data-key="passwordless">passwordless</dfn> connections, Active Directory/LDAP, Windows Azure AD and ADFS.
+
+- The `profile` scope value requests access to the End-User's default profile Claims, which are: `name`, `family_name`, `given_name`, `middle_name`, `nickname`, `preferred_username`, `profile`, `picture`, `website`, `gender`, `birthdate`, `zoneinfo`, `locale`, and `updated_at`.


End-User's->end user's

lrzhou25 · 2024-04-26T17:57:19Z

articles/api/authentication/api-authz/_resource-owner.md

+
+### Error Codes
+
+For the complete error code reference for this endpoint refer to [Errors > POST /oauth/ro](#post-oauth-ro).


comma between endpoint and refer

lrzhou25 · 2024-04-26T17:58:57Z

articles/api/authentication/api-authz/_refresh-token.md

+### Remarks
+
+- The <dfn data-key="scope">scopes</dfn> issued to the application may differ from the scopes requested. In this case, a `scope` parameter will be included in the response JSON.
+- If you don't request specific scopes, all scopes defined for the audience will be returned due to the implied trust to the application in this grant. You can customize the scopes returned in a rule. For more information, refer to [Calling APIs from Highly Trusted Applications](/api-auth/grant/password).


For more information->To learn more

lrzhou25 · 2024-04-29T18:07:24Z

articles/api/authentication/api-authz/_auth-code-flow.md

+|:-----------------|:------------|
+| `audience` <br/> | The unique identifier of the target API you want to access. |
+| `scope` | The <dfn data-key="scope">scopes</dfn> which you want to request authorization for. These must be separated by a space. You can request any of the [standard OpenID Connect (OIDC) scopes](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims) about users, such as `profile` and `email`, custom claims that must [conform to a namespaced format](/tokens/guides/create-namespaced-custom-claims), or any scopes supported by the target API (for example, `read:contacts`). Include `offline_access` to get a <dfn data-key="refresh-token">Refresh Token</dfn>. |
+| `response_type` <br/><span class="label label-danger">Required</span> | Indicates to Auth0 which OAuth 2.0 flow you want to perform. Use `code` for Authorization Code Grant Flow. |


"want to perform"->"want to use?"

lrzhou25 · 2024-04-29T18:08:27Z

articles/api/authentication/api-authz/_auth-code-flow.md

+| `state` <br/><span class="label label-primary">Recommended</span> | An opaque value the application adds to the initial request that Auth0 includes when redirecting the back to the application. This value must be used by the application to prevent CSRF attacks. |
+| `redirect_uri` | The URL to which Auth0 will redirect the browser after authorization has been granted by the user. |
+| `connection` | The name of the connection configured to your application. |
+| `prompt` | To initiate a [silent authentication](/api-auth/tutorials/silent-authentication) request, use `prompt=none` (see Remarks for more info). |


should you link to the Remarks section below? also suggested rewording: "To learn more, read Remarks"

See that's one of the drawbacks with Remarks. I can't link to them. The link just goes back to the first one in Login with #remarks. But! With the next project, hopefully we can fix this. But I will update to the To learn more, see the Remarks.

lrzhou25 · 2024-04-29T19:01:03Z

articles/api/authentication/api-authz/_highly-regulated.md

+:::
+<br></br>
+
+Authorization Code Flow with [Push Authorization Requests (PAR)](/get-started/authentication-and-authorization-flow/authorization-code-flow/authorization-code-flow-with-par), uses the `/oauth/par` endpoint to allow applications to send the authorization parameters usually sent in a `GET` request to `/authorize`. PAR uses a POST method from the backend to keep parameter values secure. The /oauth/par endpoint accepts all authorization parameters which can be proivided to `/authorize`. Assuming the call to the `/oauth/par` endpoint is valid, Auth0 will respond with a `redirect_uri` value that can be used as a parameter for the `/authorize` endpoint.


Push Authorization Requests->Pushed Authorization Requests
no comma after (PAR)
/oauth/par endpoint accepts->/oauth/par endpoint accepts

lrzhou25 · 2024-04-29T19:02:29Z

articles/api/authentication/api-authz/_highly-regulated.md

+
+Authorization Code Flow with [Push Authorization Requests (PAR)](/get-started/authentication-and-authorization-flow/authorization-code-flow/authorization-code-flow-with-par), uses the `/oauth/par` endpoint to allow applications to send the authorization parameters usually sent in a `GET` request to `/authorize`. PAR uses a POST method from the backend to keep parameter values secure. The /oauth/par endpoint accepts all authorization parameters which can be proivided to `/authorize`. Assuming the call to the `/oauth/par` endpoint is valid, Auth0 will respond with a `redirect_uri` value that can be used as a parameter for the `/authorize` endpoint.
+
+Assuming the call to the `/oauth/par` endpoint is valid, Auth0 will respond with a `redirect_uri` value also used as a parameter for the `/authorize` endpoint. To learn more about configuring PAR, read [Configure Push Authorization Requests (PAR)](/get-started/applications/configure-par).


Configure Push Authorization Requests->Configure Pushed Authorization Requests

lrzhou25 · 2024-04-29T19:04:22Z

articles/api/authentication/api-authz/_highly-regulated.md

+| `nonce` <br/><span class="label label-primary">Recommended</span> | A string value which will be included in the ID Token response from Auth0, used to prevent token replay attacks. It is required for `response_type=id_token` token. |
+| `connection` | The name of the connection configured to your application. If null, it will redirect to the [Auth0 Login Page](https://${account.namespace}/login) and show the Login Widget using the first database connection. |
+| `prompt` | Can be used to force a particular prompt to display, e.g. `prompt=consent` will always display the consent prompt.|
+| `organization` | ID of the organization to use when authenticating a user. When not provided, if your application is configured to Display Organization Prompt, the user will be able to enter the organization name when authenticating. |


nvm i see that for all the other instances of this paramter, Display Organization Prompt is bolded i.e. Display Organization Prompt, so i think we can just bold it to be consistent

Amanda VS added 3 commits March 28, 2024 14:14

Authentication API updates

858c4f3

HRI addition

Updates for Auth API Exp

27e9116

HRI update Break out client grants #Learn More standardization Error pages into Markdown tables

Commits

d5a5e86

Clean-up Final markdown tables addition of fapi to glossary for HRI entry

avanscoy added the do-not-merge label Mar 28, 2024

Amanda VS added 3 commits March 28, 2024 15:58

Update _device-code.md

6ddd024

Duplicate Learn More

Updates after local run review

c0513ab

Last commits for final fixes

377fdd3

Fixes for the nav, flow files, updated error codes

pdillon reviewed Apr 25, 2024

View reviewed changes

articles/api/authentication/index.md Outdated Show resolved Hide resolved

avanscoy and others added 3 commits April 25, 2024 17:31

Update articles/api/authentication/index.md

50751d6

Co-authored-by: Patrick Dillon <pdillon@users.noreply.github.com>

Revoke has been added the the Refresh Token page

2af37d3

Merge branch 'master' into docs-3689-auth-explorer-update

3e8f969

edgarchirivella-okta reviewed Apr 26, 2024

View reviewed changes

dlozlla reviewed Apr 26, 2024

View reviewed changes

Update _introduction.md

c7c4505

lrzhou25 reviewed Apr 26, 2024

View reviewed changes

Amanda VS added 2 commits April 26, 2024 15:44

First batch of commits

326321c

Small edits for older content

8aa2579

lrzhou25 previously approved these changes Apr 26, 2024

View reviewed changes

Last commits from HRI

6be0644

avanscoy dismissed lrzhou25’s stale review via 6be0644 April 29, 2024 17:17

lrzhou25 reviewed Apr 29, 2024

View reviewed changes

lrzhou25 previously approved these changes Apr 29, 2024

View reviewed changes

Last edits for the smaller project

5836e59

avanscoy dismissed lrzhou25’s stale review via 5836e59 April 29, 2024 19:26

avanscoy requested a review from lrzhou25 April 29, 2024 19:57

avanscoy removed the do-not-merge label Apr 29, 2024

nick-gagliardi self-assigned this Apr 29, 2024

Merge branch 'master' into docs-3689-auth-explorer-update

690e390

lrzhou25 previously approved these changes Apr 29, 2024

View reviewed changes

Remove pending redirect

52a45fc

avanscoy dismissed lrzhou25’s stale review via 52a45fc April 29, 2024 20:44

lrzhou25 approved these changes Apr 29, 2024

View reviewed changes

avanscoy merged commit 248e423 into master Apr 29, 2024
6 checks passed

avanscoy deleted the docs-3689-auth-explorer-update branch April 29, 2024 21:17

	The `/oauth/token` endpoint will respond with a JSON object containing an `id_token` property, and potentially also a `refresh_token` if one was requested.
	The `/oauth/token` endpoint will respond with a JSON object containing an `access_token` property, and potentially also a `refresh_token` if one was requested. If you specified the authorization_details parameter at the beginning of the flow, it will also be added to the response to indicate the details of what has been authorized.

	When users are redirected to `/authorize`, you need to make a `POST` call to the `oauth/token` endpoint to exchange an authorization code for an access and/or an ID token.
	When users are redirected back to your callback, you need to make a `POST` call to the `oauth/token` endpoint to exchange an authorization code for an access and/or an ID token.


		1. At the OAuth2 / OIDC tab, click OAuth2 / OIDC Login.

		### Use Authentication API Debuggar


		- This endpoint only works for database connections, <dfn data-key="passwordless">passwordless</dfn> connections, Active Directory/LDAP, Windows Azure AD and ADFS.

		- The `profile` scope value requests access to the End-User's default profile Claims, which are: `name`, `family_name`, `given_name`, `middle_name`, `nickname`, `preferred_username`, `profile`, `picture`, `website`, `gender`, `birthdate`, `zoneinfo`, `locale`, and `updated_at`.


		### Error Codes

		For the complete error code reference for this endpoint refer to [Errors > POST /oauth/ro](#post-oauth-ro).


		Authorization Code Flow with [Push Authorization Requests (PAR)](/get-started/authentication-and-authorization-flow/authorization-code-flow/authorization-code-flow-with-par), uses the `/oauth/par` endpoint to allow applications to send the authorization parameters usually sent in a `GET` request to `/authorize`. PAR uses a POST method from the backend to keep parameter values secure. The /oauth/par endpoint accepts all authorization parameters which can be proivided to `/authorize`. Assuming the call to the `/oauth/par` endpoint is valid, Auth0 will respond with a `redirect_uri` value that can be used as a parameter for the `/authorize` endpoint.

		Assuming the call to the `/oauth/par` endpoint is valid, Auth0 will respond with a `redirect_uri` value also used as a parameter for the `/authorize` endpoint. To learn more about configuring PAR, read [Configure Push Authorization Requests (PAR)](/get-started/applications/configure-par).

Docs 3689 auth explorer update #10394

Docs 3689 auth explorer update #10394

Conversation

avanscoy commented Mar 28, 2024

edgarchirivella-okta left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

edgarchirivella-okta Apr 29, 2024 • edited Loading

Choose a reason for hiding this comment

edgarchirivella-okta Apr 26, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

lrzhou25 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

edgarchirivella-okta Apr 29, 2024 •

edited

Loading

edgarchirivella-okta Apr 26, 2024 •

edited

Loading