Skip to main content
Generally off-the-shelf software will only need to be configured with the location of the Authorization URL, a Client ID, and a Client Secret for proper setup. Afterwards, the software should be prepared to authorize with Stytch. If, however, you are implementing your own Connected App, or just curious, it’s worth understanding the second part of the Authorization Code Flow—what happens upon the Connected App receiving the redirect.

​
Server Side Flow

The server side flow is very similar to Stytch’s M2M Authentication (for B2B, for Consumer) in that we will be exchanging the Connected App’s own credentials for an access token. The difference in this case is that we will also exchange the code returned from integrating with the SDK or API. This code represents the ability of the client app to act on behalf of the user. Conceptually the code can be thought of as representing permission from the user to enable the app to see their data and act on their behalf. To perform the token exchange, just as in M2M Authentication, we will make a POST request to your project’s Token Endpoint. The endpoint is located at https://${projectDomain}/v1/oauth2/token (or similar, depending on your Stytch test or production environment or CNAME settings). See this guide to learn more about setting up a custom domain. The request should contain these parameters:
NameMeaning
grant_typeThe type of auth grant we’re seeking. For Authorization Code Flow this is always authorization_code
codeThe code received in a parameter of the request sent to the Redirect URL.
client_idThe Stytch client app id, which you will receive when configuring a Client App (below)
client_secretThe Stytch Connected App’s Client Secret - required for confidential clients
redirect_uriWhile there is no redirect issued from this request redirect_uri must be present and identical to the value used in the first part of the flow.
code_verifierRequired for public clients, see this guide
For example, here is what such a request might look like using curl: 
curl --request POST \
  --url https://${projectDomain}/v1/oauth2/token \
  -d grant_type="authorization_code" \
  -d client_id="$CONNECTED_APP_CLIENT_ID" \
  -d client_secret="$CONNECTED_APP_CLIENT_SECRET" \
  -d code="$CODE_FROM_REDIRECT_PARAMETERS" \
  -d redirect_uri="$REDIRECT_URL"
The response from this request will be a JSON payload with the access token for authorizing requests from the Client App.