OpenID Authorization Code Grant

ReadyAPI retrieves the OpenID Connect ID Token in almost the same way as an OAuth 2.0 access token when you use Implicit and Authorization Code grants.

When the Authorization Code grant connect flow runs, the resource owner first provides access. An authorization code then goes to the client through a browser redirect. The client uses it to get an access token. ReadyAPI also sends a refresh token, optionally.

OAuth2
The Get OpenID Connect Token dialog in ReadyAPI showing the Authorization Code Grant configuration, with fields for Client Identification, Client Secret, Authorization URL, Access Token URL, Redirect URL, Audience, Scope, and State, along with checkboxes
OAuth2 Azure
The Get OpenID Connect Token (Azure) dialog in ReadyAPI showing the Authorization Code Grant configuration, with fields for Client Identification, Client Secret, Response Mode, Resource, Prompt, Login Hint, Domain Hint, Authorization URL, Access Token URL

Option

Description

OpenID Connect Flow

The OpenID Connect method to use.

Client Identification

An alphanumeric string used to identify the client.

Client Secret

The secret string the client uses.

Response Mode

(Azure only) Specifies how the authorization server sends the access token. Available options:

  • not defined - The authorization server defines which method to use.

  • form_post - The token is sent as an HTML form by using the POST method.

  • query - The token is added to the query as a parameter.

Resource

(Azure only) The App ID URI of the web service.

Prompt

(Azure only) Specifies whether the authentication server prompts the user to log in or to consent, even if they are already logged in. Possible values:

  • not defined - The server does not prompt a user to log in.

  • login - The server asks the user to log in again.

  • consent - The server asks the user to consent.

  • admin-consent - The server asks for the administrator's consent.

Login Hint

(Azure only) The string displays as a login hint in the sign-in form.

Domain Hint

(Azure only) Specifies the domain the user signs in to.

Authorization URL

The authorization server URL.

Access Token URL

The URL to use to get an access token.

Redirect URL

The URL you will be redirected to after successful authorization.

Audience

Identifies the intended recipient of the token. Some authorization servers require this value to specify the target API or resource that accepts the token.

Additional Parameters

Custom name–value pairs to include in the OpenID Connect token request. ReadyAPI appends these parameters to the request body and supports property expansion for their values.

Scope

The full scope string defining the requested permissions.

State

(Azure only) The value included in the request that the authorization server also adds to the token response. Use it to provide a randomly generated string to prevent a cross-site request forgery attack.

Use Authorization Header

Select to send client credentials in the request header. Otherwise, the credentials are sent in the request body.

Enable PKCE

Enables Proof Key for Code Exchange (PKCE) for the authorization request. PKCE adds a security layer by preventing the interception of authorization codes and is commonly required for public clients and OpenID Connect flows.

Get OpenID Token

Click to retrieve the OpenID Connect token.

Automation

Opens the Automated Token Profile editor.

See Also

In this section:
© 2026
Publication date: