Exchange an authorization code

An access_token is valid for one hour. You can use the /oauth/token operation to request a new one in order to keep a user authenticated for the length of your site or application’s session.

If you pass the value code in the response_type parameter, an authorization code will be returned upon successful login or registration. The authorization code must then be passed to a server and exchanged for an access token and refresh token.

$api_call= '/oauth/token';
$params= array(
    'client_id'=> JANRAIN_LOGIN_CLIENT_ID,
    'client_secret'=> JANRAIN_LOGIN_CLIENT_SECRET,
    'redirect_uri'=> 'https://localhost'
    'grant_type'=> 'authorization_code',
    // authorization code from user login/registration
    'code'=> $_POST['authorization_code']
);
$curl= curl_init();
curl_setopt($curl,CURLOPT_URL,JANRAIN_CAPTURE_URL.$api_call);
curl_setopt($curl,CURLOPT_POST,true);
curl_setopt($curl,CURLOPT_RETURNTRANSFER,true);
curl_setopt($curl,CURLOPT_POSTFIELDS,http_build_query($params));
$api_response= json_decode(curl_exec($curl));
curl_close($curl);

These tokens must be stored in the server session and refreshed as needed using the /oauth/token operation.

When a user interacting with the site or app attempts an action that requires an access token (e.g. save profile), a server-side script can be called to generate a new valid access token and pass it back to re-attempt the action.