/oauth/auth_native

This endpoint is used to complete social login. To make this call, you must have a valid Social Login token received after a user successfully authenticates through one of the identity providers you have enabled for your Social Login application. See Implementing Social Login for more information on how to get Social Login tokens. Click here for a video demo in Postman.

Note. This must be a POST request with all parameters included in the body of the request; they cannot be passed as URL parameters.

This endpoint includes the following methods:

  • POST

POST

Base URL

The base URL for this endpoint is your Janrain Capture domain; for example:

https://educationcenter.us-dev.janraincapture.com

Your Capture domains (also known as Registration domains) can be found in the Janrain Console on the Manage Application page:

Examples

Example 1: Complete Social Authentication

The example below shows a typical call to complete social authentication for a user after a Social Login token is received.


curl -X POST \
  --data-urlencode 'client_id=12345abcde12345abcde12345abcde12'\
  --data-urlencode 'flow=standard'\
  --data-urlencode 'flow_version=67890def-6789-defg-6789-67890defgh67'\
  --data-urlencode 'locale=en-US'\
  --data-urlencode 'redirect_uri=http://localhost'\
  --data-urlencode 'response_type=token'\
  --data-urlencode 'registration_form=socialRegistrationForm'\
  --data-urlencode 'token=ab12cd34ef56gh78ij90kl12mn34op56qr78st78'\
  'https://my-app.janraincapture.com/oauth/auth_native'
                                                            

Running Code Samples Using Postman

The Janrain REST API code samples are written using Curl, but they can easily be run from within Postman. To use one of our code samples in Postman:

  1. Click the Copy to Clipboard button located directly beneath the code sample
  2. In Postman, click Import to display the Import dialog box.
  3. In the Import dialog box, click Paste Raw Text, and then paste in the copied code. The Import dialog box should look similar to this:

  4. Click Import, and the Curl command will be converted to a format that can be run from within Postman. All you need to do now is configure the command to work with your Janrain implementation.

If the user does not exist in the Janrain Registration database, the error response will include profile information from the IDP that can be used to register the user via a call to oauth/register_native. Only data defined in the form specified in the registration_form parameter will be returned in this error response.

Example 2: Merge Social Accounts

The next example shows a call made to merge a new social account into an existing user record. The token parameter uses a Social Login token for the account that already exists in your Registration database, and the merge_token parameter uses a Social Login token for the new account through which the user has authenticated.


curl -X POST \
  --data-urlencode 'client_id=12345abcde12345abcde12345abcde12'\
  --data-urlencode 'flow=standard'\
  --data-urlencode 'flow_version=67890def-6789-defg-6789-67890defgh67'\
  --data-urlencode 'locale=en-US'\
  --data-urlencode 'redirect_uri=http://localhost'\
  --data-urlencode 'response_type=token'\
  --data-urlencode 'token=12ab34cd56ef78gh90ij12kl34mn56op78qr90st'\
  --data-urlencode 'merge_token=ab12cd34ef56gh78ij90kl12mn34op56qr78st78'\
  'https://my-app.janraincapture.com/oauth/auth_native'
                                                            

Running Code Samples Using Postman

The Janrain REST API code samples are written using Curl, but they can easily be run from within Postman. To use one of our code samples in Postman:

  1. Click the Copy to Clipboard button located directly beneath the code sample
  2. In Postman, click Import to display the Import dialog box.
  3. In the Import dialog box, click Paste Raw Text, and then paste in the copied code. The Import dialog box should look similar to this:

  4. Click Import, and the Curl command will be converted to a format that can be run from within Postman. All you need to do now is configure the command to work with your Janrain implementation.

Authorized Clients

  • login_client

Security

  •  none-required

Query Parameters

Parameter Type Required Description
client_id string Yes API client ID used to authenticate the call. This client must be configured with the login_client feature, which gives it permission to use login and registration-based API endpoints. API client permissions may be configured by using the clients/set_features endpoint.
 
flow string Yes Name of the flow configured with the login experience you want to use. This parameter corresponds to the janrain.settings.capture.flowName JavaScript setting used in widget- based implementations. The default flow provisioned with Registration applications is named the standard flow; if you have multiple flows, you can find a list of valid flow names using the Configuration API. You may cb this parameter if you configure the flow name in the default_flow_name setting for the API client used to make this call.
 
flow_version string Yes Version number of the flow set in the flow parameter. This parameter corresponds to the janrain.settings.capture.flowVersion JavaScript setting used in widget-based implementations; however, this call will not accept a version of HEAD. Instead, you must specify the version number if you want to use the most recent version. You can find a list of versions for your flow using the Configuration API. This parameter can be omitted if you you configure the flow version in the default_flow_version setting for the API client used to make this call.
 
locale string Yes Code for the language you want to use for the social login experience. This parameter determines the language for any error messages returned to you and corresponds to the janrain.settings.language JavaScript setting used in widget-based implementations. The default locale provisioned with the standardRegistration flow is en-US; other locales must be configured in your flow. You can find a list of valid locales for your flow using the Configuration API.
 
merge_token string If you have had a previous call fail with code 380 email_address_in_use error, you can merge the new social account into the existing one by including the merge_token parameter in this call or the auth_native_traditional call authenticating the user's existing account. The token value for this parameter must be the same token from the previous failed auth_native call.
redirect_uri string Yes Required for legacy purposes and is not used for any functionality in this call. The parameter value must begin with http:, or https:, and we recommend that this match the URL and protocol of your website. This parameter corresponds to the janrain.settings.capture.redirectUri JavaScript setting used in widget-based implementations.
 
registration_form string Name of the form used for social registration. This parameter determines what is included in the error response if no existing record can be found wthat uses the same email address as the one returned by the social provider after a successful authentication. When set, the response will include values for prereg_fields, which includes data from the social provider's payload mapped to fields in your social registration form. You can use this data to pre-populate the parameters for the oauth/register_native. The default form name for social registration configured for the standard flow is socialRegistrationForm. You can find a list of valid forms and associated fields for your flow using the Configuration API. This form name corresponds to the name of the JTL tag used for the social registration form in widget-based implementations (for example, {* #socialRegistrationForm *}).
 
response_type string Determines whether you will receive an access token, an authorization code, or both after a user is successfully registered or authenticated; if omitted, the response type will default to token. This parameter corresponds to the janrain.settings.capture.responseTypeJavaScript setting used in widget-based implementations. Allowed values are:
  • code
  • token
  • code_with_token
thin_registration boolean Determines the behavior of the auth_native call if no existing record is found that uses the same email address as the one returned by the social provider after a successful authentication. If true, this endpoint creates a new record immediately, and social data will be stored in the profiles section of the user record. The standard flow provisioned with Registration applications is also configured to copy social data, if available, to the top-level schema attributes for email, displayName, givenName, and familyName upon record creation. If set to false or omitted from the call, you will need to complete two-step registration using oauth/register_native. See the registration_form parameter for info on how to gather data from the social provider response for use in the social registration form.
 
token string Yes One-time token used for social authentication. This is the token passed from the Social Login application to your token URL. It must be received from the same Social Login application that is configured for the API client used to make this call; this may be configured in the Default Settings for your Registration application if you have a single Social Login application. The token will be a unique 40 character string and can also be used with the auth_info endpoint to retrieve a user's social profile directly; however, this is not necessary when using these oauth endpoints for registration since that data is retrieved and stored for you.
 

Responses

200 OK

Successful Response

A successful response will return the user profile in the capture_user object along with an access_token or authorization_code depending on the response_type parameter set in the call. Note that is_new will reflect true if the user did not previously exist and you have thin_registration set to true.


{
  "capture_user": {
    "created": "2016-04-20 17:02:18.649505 +0000",
    "uuid": "67890def-6789-defg-6789-67890defgh67",
    // additional profile data...
  },
  "is_new": false,
  "stat": "ok",
  "access_token": "z0y98xv76u5t4rs3"
}
                                                            

Error - User Not Yet Registered

The example error response below indicates that neither the user's social identity nor the email address returned by the provider are currently registered. You may proceed to register the user with the oauth/register_native call using the same Social Login token passed into the previous call. If your call included the registration_form parameter, the error response will include prereg_fields with data from the social provider's payload mapped to fields in your social registration form. Note that this error may still be encountered when thin_registration is set to true if the chosen social provider does not return an email address.


{
  "stat": "error",
  "code": 310,
  "error_description": "no such user",
  "error": "record_not_found",
  "request_id": "d9yrm9g7vfrh7bk3",
  "prereg_fields": {
    "firstName": "John",
    "middleName": null,
    "lastName": "Doe",
    "emailAddress": "johndoe@example.com",
    "displayName": "JohnDoe",
    "mobile": null,
    "optInRegistration": false,
    "gender": "",
    "birthdate": null,
    "phone": null,
    "addressStreetAddress1": null,
    "addressStreetAddress2": null,
    "addressCity": null,
    "addressPostalCode": null,
    "addressState": "",
    "addressCountry": ""
  }
}
                                                            

Error - Email Address Already Registered

The example error response below indicates that the user's social identity is not currently registered but the email address returned by the provider matches an existing record. You may proceed to ask the user to authenticate through the existing account and then merge in the new social account by using the first Social Login token for the merge_token parameter in the next call. If the response indicates that the existing provider is capture, use the oauth/auth_native_traditional call; otherwise use auth_native again after getting a Social Login token for the existing account, which will be passed in the token parameter.


{
  "stat": "error",
  "code": 380,
  "error_description": "a user already exists with that email address",
  "error": "email_address_in_use",
  "request_id": "x4jdsa9mbajg7hsj",
  "existing_provider": "googleplus",
  "existing_display_name": "janedoe",
  "existing_photo": {
    "id": 10628,
    "value": "https://lh3.googleusercontent.com/fyd7jkgbnjLBX/AAAAAAAAAAI/AAAAAAAAAAA/hjsGTSDljl/photo.jpg?sz=400",
    "type": "other"
  },
  "existing_date_created": "2016-04-21 23:13:58.437196 +0000"
}
                                                            

Error - Invalid Social Login Token

The example error response below indicates that the Social Login token passed into the call is invalid or expired.


{
  "stat": "error",
  "code": 200,
  "error_description": "invalid token",
  "error": "invalid_argument",
  "request_id": "zygzvaatua8ezk2v"
}
                                                            

Error - Missing Required Parameters

The example error response below indicates that one of the required parameters for the call was not included. The error message will describe which parameter is missing.


{
  "stat": "error",
  "code": 100,
  "error_description": "missing arguments: flow",
  "error": "missing_argument",
  "request_id": "uyeem84bmqmnjuu4"
}
                                                            

Error - Invalid Flow Value

The example error response below indicates that the value provided for one or more of the flow, flow_version, or locale parameters is invalid. Flow versions are unique across environments, so check that the version value included in the call is for the correct environment (that is, your development or production application).


{
  "stat": "error",
  "code": 500,
  "error_description": "could not find a flow named 'standard' with version '12345abc-1234-abcd-1234-12345abcde12' and locale 'en-US'",
  "error": "unexpected_error",
  "request_id": "murynd7fhpysq6um"
}
                                                            

Error - Invalid API Client Permissions

The example error response below indicates that the API client used to make the call is not configured with the login_client feature.


{
  "stat": "error",
  "code": 403,
  "error_description": "This client does not support log in and registration.",
  "error": "permission_error",
  "request_id": "y3sthb9dey6mv65e"
}