oauth2/com.okta.oauth2.kmp/AuthorizationCodeFlow

AuthorizationCodeFlow

Encapsulates the behavior required to authenticate using the OIDC Authorization Code flow with PKCE.

Call start to obtain an AuthorizationCodeFlowContext whose AuthorizationCodeFlowContext.url you open with a BrowserRedirectHandler. Once the browser redirects back to the registered redirect URI, pass that captured URI along with the same AuthorizationCodeFlowContext to resume to exchange the authorization code for tokens.

See Authorization Code Flow documentation

Types

Companion

object Companion

MissingResultCodeException

class MissingResultCodeException : Exception

Thrown by resume when no authorization code is present in the redirect URI.

PushedAuthorizationException

sealed class PushedAuthorizationException : Exception

Common base for the two exceptions start throws when Pushed Authorization Requests (PAR) cannot be completed. Catch this type to handle "PAR didn't work" generically, or catch the specific subtype (PushedAuthorizationRequiredException or PushedAuthorizationRequestException) to distinguish a server-mandated failure from an optional one.

PushedAuthorizationRequestException

class PushedAuthorizationRequestException(message: String, cause: Throwable? = null) : AuthorizationCodeFlow.PushedAuthorizationException

Thrown by start when PAR is optional, the PAR request fails, and OAuth2Client.configuration's allowPushedAuthorizationRequestFallback is disabled.

PushedAuthorizationRequiredException

class PushedAuthorizationRequiredException(message: String, cause: Throwable? = null) : AuthorizationCodeFlow.PushedAuthorizationException

Thrown by start when PAR is required by the authorization server (require_pushed_authorization_requests) but cannot be used — either no PAR endpoint was discovered, or the PAR request itself failed and fallback is not applicable because the server mandates PAR.

RedirectSchemeMismatchException

class RedirectSchemeMismatchException : Exception

Thrown by resume when the redirect URI scheme does not match the configured redirect URL.

ResumeException

class ResumeException(message: String, val errorId: String) : Exception

Thrown by resume when the redirect could not be validated or the authorization server returned an error.

Properties

client

abstract val client: ERROR CLASS: Symbol not found for OAuth2Client

The OAuth2Client instance used for token requests.

Functions

resume

abstract suspend fun resume(uri: String, flowContext: AuthorizationCodeFlowContext): ERROR CLASS: Symbol not found for Result<ERROR CLASS: Symbol not found for TokenInfo>

Completes the Authorization Code redirect flow by exchanging the authorization code for tokens.

resume

suspend fun AuthorizationCodeFlow.resume(uri: Uri, flowContext: AuthorizationCodeFlowContext): Result<TokenInfo>

Resumes the Authorization Code flow using an Android android.net.Uri.

start

abstract suspend fun start(redirectUrl: String, scope: List<String> = client.configuration.defaultScope, extraRequestParameters: Map<String, String> = emptyMap()): ERROR CLASS: Symbol not found for Result<com/okta/oauth2/kmp/AuthorizationCodeFlowContext>

Initiates the Authorization Code redirect flow.