Authorization Code Grant
The Authorization Code grant is one of the OAuth 2.0 grant types supported in ReadyAPI. With this grant, the resource owner provides access, and an authorization code is sent to the client through a browser redirect. The client uses it to obtain an access token. Optionally, a refresh token is also sent.
To configure OAuth 2.0 authentication in ReadyAPI, see Enabling OAuth 2.0 Authentication or Enabling OAuth 2.0 Authentication with Azure Active Directory.
 |
 |
Options | Description |
|---|---|
OAuth 2 Flow | Sets the OAuth 2.0 method to use. |
Client Identification | An alphanumeric string that identifies the client. |
Client Secret | The secret string the client uses. |
Response Mode | (For Azure only) Specifies how the authorization server sends the access token. Available options:
|
Resource | (Azure only) The App ID URI of the web service. ImportantMicrosoft Identity Platform v2.0 does not support this parameter. |
Prompt | (Azure only) Specifies whether the authentication server prompts the user to log in or to consent, even if they are already logged in. Possible values:
|
Login Hint | (Azure only) The string is displayed as a login hint in the sign-in form. |
Domain Hint | (Azure only) Specifies the domain the user should use to sign in. |
Authorization URL | The authorization server URL. |
Access Token URL | The URL to use to get an access token. |
Redirect URL | An authorized redirect URL registered for the application. In OAuth 2.0 terms, the web service redirects to this URL after successful authentication. To learn more about a redirect URL, see the OAuth 2.0 documentation. TipFor testing, use |
Audience | The URI that identifies the target resource or API the access token is intended for. |
Apply Client JWT Assertion | Select to include a JSON Web Token (JWT) assertion in the authorization request. |
Additional Parameters | Select to add custom name–value pairs to the OAuth 2.0 access token request body. ReadyAPI appends the parameters to the request and supports property expansion. |
JWT Assertion | Specifies the JWT included in the authorization request as a JWT assertion. Enter it manually or generate it. Available when you select Apply Client JWT Assertion. |
Generate JWT | Click to generate a JWT. The token is written to the JWT Assertion field. See Generating JSON Web Token. Available when you select Apply Client JWT Assertion. |
Scope | The full |
Use Nonce | Select to generate a unique string for each request. This lets the server verify that a request has not been made before and helps prevent replay attacks. |
State | A value included in the request, also added to the token response. Use it to generate a random string to prevent cross-site request forgery attacks. |
Use Authorization Header | Select to send client credentials in the request header. If not selected, credentials are sent in the request body. |
Enable PKCE | Select to use the OAuth-PKCE authorization flow. When selected, the Code Challenge Method option becomes available. |
Code Challenge Method | The method used to derive the code challenge. Possible values: Not defined, plain, SHA256. Available when you select Enable PKCE. |
Get Access Token | Click to retrieve the access token. |
Automation | Click to open the Automated Token Profile editor. |