Authorization Code Flow

The following diagrams show the OAuth2 Authorization Code Flow separated by license type. The user is included as an actor because the user starts the flow via the login button, enters credentials, and grants consent if required.

Basic

With Basic, the Authorization Code Flow is only used to confirm a successful DocCheck authentication. Scopes, state, and consent cannot be used; retrieving user data is not possible.

Economy/Business

With Economy and Business, the Authorization Request can additionally contain scope and state. If scopes are requested, a consent form may be required. Afterwards, granted user data can be retrieved through the user data endpoint.

Auth Code Flow at a glance

This simplified view explains the Authorization Code Flow without deep technical details.

Consent is only available with Economy and Business.

Basic specifics

• No state possible.
• No scope request possible.
• No consent form possible.
• No user data retrieval through the user data endpoint.
• The flow ends after the authorization code has been successfully exchanged for an access token.

Notes

• The authorization code is passed to the redirect_uri after successful authentication.
• The token exchange is performed server-side via POST /token.
• In Basic, the access token only confirms successful DocCheck authentication; the Basic auth flow ends there.
• With Economy/Business, scope and state can optionally already be sent in the authorization request.
• If scopes are requested, this can require a consent form.
• The consent form can be skipped if the user has already granted consent for this client.
• The user data endpoint can only be used with a valid access token if license, scopes, and consent match.