Authorization Code Flow Implementation Guide

// Request User Authorization
const authorizationUrl = new URL(`${authServerUrl}/protocol/openid-connect/auth`);
authorizationUrl.searchParams.append('response_type', 'code');
authorizationUrl.searchParams.append('client_id', clientId);
authorizationUrl.searchParams.append('redirect_uri', redirectUri);
authorizationUrl.searchParams.append('scope', 'openid profile email');
authorizationUrl.searchParams.append('state', generateRandomState());

// Redirect user to authorization URL
window.location.href = authorizationUrl.toString();

// Exchange authorization code for tokens
async function exchangeCodeForToken(code) {
const response = await fetch(`${authServerUrl}/protocol/openid-connect/token`, {
  method: 'POST',
  headers: {
    'Content-Type': 'application/x-www-form-urlencoded'
  },
  body: new URLSearchParams({
    grant_type: 'authorization_code',
    client_id: clientId,
    client_secret: clientSecret,
    code: code,
    redirect_uri: redirectUri
  })
});

const tokens = await response.json();
return tokens;
// Returns: { access_token, refresh_token, id_token }
}