Authentication

Initiates an OAuth/OpenAuth authorization request and returns the data required to continue the authorization flow. This operation validates the incoming authorization context (e.g., client identity, requested grant/response type, redirect URI, and scope) and, when applicable, issues an authorization code tied to the request. It also supports additional flow parameters such as state for CSRF protection and code_challange / PKCE-related inputs to harden public-client scenarios. On success, the response provides the redirect_uri, code, and state values needed by the client to complete the next step of the flow.

Exchanges valid credentials or artifacts for OAuth tokens according to the requested grant_type. Depending on the flow, the request can include user credentials, an authorization code, a refresh_token, or an assertion, alongside client_id / client_secret (and optionally code_verifier for PKCE). The service validates the client, verifies the grant-specific inputs, and enforces scope rules before issuing tokens. On success, it returns an access_token, token_type, expires_in, and optionally a refresh_token to enable session continuation without re-authentication.

Part of:

• Journey 01 · Launching a new card product — step 1, Get an access token

• Journey 01 · Launching a new card product — step 1, Get an access token

• Journey 01 · Launching a new card product — step 1, Get an access token

Revoke Token

Introspect Token