OAuth 2.0

Authorization Code + PKCE

Use this flow when an application needs a ThreatPrevent user's approval. PKCE with SHA-256 and an exact registered redirect URI are mandatory.

1. Start authorization

Browser redirect

https://api.threatprevent.io/oauth/authorize?response_type=code&client_id=CLIENT_ID&redirect_uri=https%3A%2F%2Fapp.example.com%2Fcallback&scope=openid%20profile%20risk%3Apayment&state=RANDOM_STATE&nonce=RANDOM_NONCE&code_challenge=BASE64URL_SHA256_VERIFIER&code_challenge_method=S256

Generate and retain a high-entropy state value and PKCE verifier. Validate state when the browser returns. Include a nonce when requesting OpenID Connect identity information.

2. Exchange the code

Token request

curl -sS -X POST https://api.threatprevent.io/oauth/token \
+  -H 'Content-Type: application/x-www-form-urlencoded' \
+  --data-urlencode 'grant_type=authorization_code' \
+  --data-urlencode 'client_id=CLIENT_ID' \
+  --data-urlencode 'code=RETURNED_CODE' \
+  --data-urlencode 'redirect_uri=https://app.example.com/callback' \
+  --data-urlencode 'code_verifier=ORIGINAL_VERIFIER'

Authorization codes are short-lived, hashed at rest and single-use. Public clients use token authentication None; confidential clients authenticate using their configured token-endpoint method. Request offline_access only when the client is allowed to receive refresh tokens.