Start a CIBA backchannel authentication request.

POST

/bc-authorize

Code sample: Shell / cURL

curl --request POST \
  --url https://auth.example.com/bc-authorize \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data 'scope=openid profile email' \
  --data client_id=client_123 \
  --data login_hint=user@example.com \
  --data 'binding_message=Approve sign-in'

With tenant assurance enabled and a default FAL of FAL3 (with fal3_requires_par), which needs a pushed, signed authorization request, every request is refused with unauthorized_client. Assurance settings that cannot be read return 503 temporarily_unavailable, and so do the tenant’s CIBA settings (ciba.*). Those settings set the request lifetime (expires_in is ciba.expires_in when requested_expiry is absent, otherwise requested_expiry; either is kept between ciba.min_expires_in and ciba.max_expires_in), the polling interval returned to poll-mode clients (ciba.poll_interval, kept between ciba.min_interval and ciba.max_interval) and the binding_message limits. A binding_message longer than ciba.max_binding_message_length (counted in UTF-16 code units), or missing (or only whitespace) when ciba.binding_message_required is on, is refused with 400 invalid_binding_message. A request that carries a user_code (also inside a signed request object) while ciba.user_code_enabled is off, which is the default, is refused with 400 invalid_request (user_code is not supported); discovery then advertises backchannel_user_code_parameter_supported as false. With it on, the user_code is accepted, stored and shown to the person approving the request; it is not verified. The request keeps the tenant’s ciba.slow_down_increment and ciba.max_poll_count as they were when it was made; the token endpoint applies them while the client polls.

Request Body

Media type application/x-www-form-urlencoded

object

scope

required

string

client_id

required

string

client_secret

string

login_hint

string

binding_message

string

user_code

Refused with 400 invalid_request unless the tenant’s ciba.user_code_enabled is on.

string

requested_expiry

integer

Example

scope=openid+profile+email&client_id=client_123&login_hint=user%40example.com&binding_message=Approve+sign-in

Responses

200

Successful JSON response.

Media type application/json

object

auth_req_id

required

string

expires_in

required

integer

interval

integer

Example

{
  "auth_req_id": "1c266114-a1be-4252-8ad1-04986c5b9ac1",
  "expires_in": 300,
  "interval": 5
}

400

OAuth error response.

Media type application/json

object

error

required

string

error_description

string

Example ^generated

{
  "error": "example",
  "error_description": "example"
}

503

OAuth error response.

Media type application/json

object

error

required

string

error_description

string

Example ^generated

{
  "error": "example",
  "error_description": "example"
}