Get Access Token via Kinde (Authorization Code)

🚧

Prerequisites

KINDE_HOST: The base domain to use for Kinde requests, this should be provided by Latner. By default it is 'https://auth.latner.app' for Prod, or 'https://auth.latner-uat.app' for UAT.

redirect_uri: The callback URL back to your App as part of the authorization flow. Make sure to let your Latner contact know what this would be so that we can whitelist it on our end.

KINDE_CLIENT_ID: The client_id setup by Latner for your App.

KINDE_CLIENT_SECRET: The client_secret setup by Latner for your App.

Latner uses Kinde as our OAuth provider and they provide several SDKs to help setup authentication, but you can also do this without an SDK.

As a reminder, the Authorization Code Flow is as follows:

Diagram 1: Authorization Code Flow Sequence Diagram

The two steps to obtain an access_token are as follows:

1. Get an Authorization code (Number 2 in the diagram above):

   Direct your user to the OAuth Login page, the URL should look something like:

   
   

   {KINDE_HOST}/oauth2/auth
   ?response_type=code 
   &client_id={KINDE_CLIENT_ID} 
   &redirect_uri={redirect_uri} 
   &scope=openid%20profile%20email%20offline 
   &state=random

2. Exchange Authorization code for an Access Token (Number 4 in the diagram above):

   Upon Kinde redirecting back to your app using the redirect_uri, you should now have the Authorization Code in the query param.

   You can extract this and exchange it for an access token by making a POST request to {KINDE_HOST}/oauth2/token with the following payload:

   client_id={KINDE_CLIENT_ID}
   &client_secret={KINDE_CLIENT_SECRET}
   &grant_type=authorization_code
   &redirect_uri={redirect_uri}
   &code={authorization_code}

You should now have a valid access_token that you can use to make requests in Latner!

By including "offline" in the initial scope param, you should get a refresh_token alongside the access_token. You can learn more about how to use this refresh_token here.