使用 authorization_code 授予类型请求令牌

Question

I want to Request a token using the authorization_code Grant Type, I see it here: https://identitymodel.readthedocs.io/en/latest/client/token.html#

var response = await client.RequestAuthorizationCodeTokenAsync(new AuthorizationCodeTokenRequest
{
    Address = IdentityServerPipeline.TokenEndpoint,

    ClientId = "client",
    ClientSecret = "secret",

    Code = code,
    RedirectUri = "https://app.com/callback",

    // optional PKCE parameter
    CodeVerifier = "xyz"
});

But I don't know where code and CodeVerifier is getten.

Answer 1

As already you know, Authorization Code Grant contains a few steps which you need to read them from RFC 6749 - The OAuth2.0 Authorization Framework .

the authorization server redirects the user-agent back to the client using the redirection URI provided earlier (in the request or during client registration). The redirection URI includes an authorization code and any local state provided by the client earlier.

There is a flow diagram in the RFC document which help you figure out how you'll earn the code .

In summary: Your client should send Authorization Code with it's request, then you send the Code to the Authorization Server and check it's validity.