OAuth2 service

OAuth2 can already be used with the Basic license.

The DocCheck Login service supports OAuth2 based on the Authorization Code Flow (opens new window). After successful authentication on the DocCheck page, an authorization code is sent to your callback URL. You exchange this code for an access token.

What you find in this section

This page provides the entry point to the OAuth2 features of DocCheck Login. For implementation details, use the following areas:

Area	Content
Endpoints	Technical reference for authorization, access token, user data, refresh token, and error codes.
PKCE	Important details for using Proof Key for Code Exchange with the Authorization Code Flow.
Tools & examples	Implementation and testing resources, such as Postman Guide, PHP Provider, React Native, and Demo project.

Note

A detailed Authorization Code Flow diagram is currently being reviewed on the stage instance.

Authentication (Access token endpoint) ⓘEconomy

In the basic scenario, the OAuth2 service is used for authentication without retrieving personal data.

• After successful login via your client, an authorization code (code) is appended to your target URL
• The parameters client_id (Login client ID), code, and client_secret can be exchanged for an access token
• Important: The token request must include grant_type=authorization_code. Details and examples: Access token endpoint
• A successful response from the access token endpoint means the authorization code and other parameters are valid and the user has authenticated via DocCheck

Requesting personal data (User data endpoint) ⓘEconomy+

The full OAuth2 implementation includes the user data endpoint and requires an Economy license (or higher). The user data endpoint manages access permission to personal data.

• Once you have an access token, you can call the user data endpoint
• If the required license is assigned to the login client and the user has given consent, the user data endpoint returns the granted data set in JSON format
• The scope of data – scope – is defined via the login button
• Return values of the user data endpoint: Overview

---

Demo Auth (sample project)

Demo project

Try the OAuth2 flow live: https://demo-auth.doccheck.com/

• Access (htaccess): DrHouse / !Lupus
• Login: testuser-5430 / 1love2DocCheck! (profession: employee of the industry)
• Note: A verified DocCheck user is required for the demo. We can provide a test account on request.

Tools & examples

Tool / example	Description
Demo project	Live sample project for trying out the OAuth2 flow in a demo environment.
Postman collection	Helps test the Authorization Code Flow, token exchange, and user data retrieval with prepared requests.
PHP Provider	Official OAuth2 provider for PHP applications, including Composer package and example code.
React Native	Example for integrating DocCheck Login into mobile apps on iOS and Android.