POST/api/auth/session/generate-authorization-codeAuthenticated

Issue an authorization code for the current session

Mints a PKCE authorization code for client_app_id on behalf of the signed-in user without re-entering credentials (the OAuth2 authorize bridge and the consent screen use it once the user has authorized the app). The code is bound to the code challenge, the redirect_uri, the granted scopes and the nonce exactly as a fresh login would bind them.

operationId post_api_auth_session_generate_authorization_codeAuthentication

Authentication & permissionsAuthenticated

Any authenticated user

Accepted credentials
Who may call
Any authenticated user

Request body

Required

application/json
GenerateAuthorizationCodeRequestUnknown keys are rejected.
PropertyTypeDescription
client_app_id*string

Client application the authorization code is issued for

minLength: 2maxLength: 64pattern: ^[a-z0-9_-]*$

code_challenge*string

PKCE S256 code challenge (RFC 7636) the authorization code is bound to

minLength: 43maxLength: 1024

code_challenge_method*"S256"
challenge_time*number

Unix epoch milliseconds when the PKCE verifier was created; expired challenges are refused

minimum: 0

redirect_uristring (uri) | null (uri) | null

OAuth2 redirect_uri bound to the authorization code. Required for third-party client apps and must be registered for the app; omitted (or null) only when the auth server itself is the requesting app.

noncestring | null | null

OIDC login nonce (OIDC Core §3.1.2.1), echoed in the id_token at redemption. Optional.

minLength: 1maxLength: 512pattern: ^[\x20-\x7E]+$

scopestring

Requested scopes, space delimited (RFC 6749 §3.3). The server re-derives the granted subset; absent, or naming no supported scope, is a plain OAuth 2.1 grant without an id_token.

minLength: 1maxLength: 256pattern: ^[\x21\x23-\x5B\x5D-\x7E]+(?: [\x21\x23-\x5B\x5D-\x7E]+)*$

JSONExample
"client_app_id""my-web-app"
"code_challenge""string"
"code_challenge_method""S256"
"challenge_time"1.5
"redirect_uri""https://example.com"
"nonce""string"
"scope""openid profile email"

Responses

application/json
GenerateAuthorizationCodeResponse
PropertyTypeDescription
success*true
authorization_code*string

Redeem at POST /api/oidc/token with the PKCE verifier

JSONExample
"success"true
"authorization_code""string"

Example request

bashcurl
curl -X POST 'https://auth.schemavaults.com/api/auth/session/generate-authorization-code' \
  -b 'refresh_token_<auth_server_app_id>=<value>' \
  -H 'Content-Type: application/json' \
  -d '{
  "client_app_id": "my-web-app",
  "code_challenge": "string",
  "code_challenge_method": "S256",
  "challenge_time": 1.5,
  "redirect_uri": "https://example.com",
  "nonce": "string",
  "scope": "openid profile email"
}'
POST /api/auth/session/generate-authorization-code | SchemaVaults Auth API