Exchange Authorization Code

An access_token is valid for one hour. You can use the oauth/token endpoint to request a new one in order to keep a user authenticated through Janrain for the length of your site or application’s session.

If you pass the value code in the response_type parameter, an authorization code will be returned upon successful login or registration. The authorization code must then be passed to a server and exchanged for an access token and refresh token.


$api_call= '/oauth/token';
$params= array(
    'client_id'=> JANRAIN_LOGIN_CLIENT_ID,
    'client_secret'=> JANRAIN_LOGIN_CLIENT_SECRET,
    'redirect_uri'=> 'https://localhost'
    'grant_type'=> 'authorization_code',
    // authorization code from user login/registration
    'code'=> $_POST['authorization_code']
);
$curl= curl_init();
curl_setopt($curl,CURLOPT_URL,JANRAIN_CAPTURE_URL.$api_call);
curl_setopt($curl,CURLOPT_POST,true);
curl_setopt($curl,CURLOPT_RETURNTRANSFER,true);
curl_setopt($curl,CURLOPT_POSTFIELDS,http_build_query($params));
$api_response= json_decode(curl_exec($curl));
curl_close($curl);

Response

Outcome / Next Step

Success (ok)

Access token and refresh token are returned

These tokens must be stored in the server session and refreshed as needed using the oauth/token endpoint.

When a user interacting with the site or app attempts an action that requires a Janrain access token (e.g. save profile), a server-side script can be called to generate a new valid access token and pass it back to re-attempt the action.