Backchannel authentication

Request

Start a backchannel authentication process (See CIBA spec). The request can either be used to obtain a direct link (for example, to embed in a QR code) or to send the user a link by SMS or email. When opened, this link will initiate an authentication process. The request returns the authentication request ID that will be used to complete the process on the authenticating device (by calling /auth/backchannel/complete) and obtain the token. If the link channel was specified, the response will also include the link.

Bodyapplication/x-www-form-urlencodedrequired

client_idstringrequired

Client ID for which authentication is requested.

client_secretstringrequired

Client secret.

scopestringrequired

Scope of the requested access. Used to request specific user details like email. Must include openid and can include additional values (space delimited). offline_access scope allows refreshing access tokens.

Enum:"openid""email""phone""offline_access"

login_hintstringrequired

Identifier of a user for whom authentication is requested (email, phone or user_id)

binding_messagestring^[a-zA-Z0-9-._+/!?#]{1,20}$

A message intended to be displayed on both consumption and authentication devices so the end-user can see how they are interconnected for the transaction.

The message needs to be 1 - 20 characters in length and should contain only digits, alphabet and the characters: -._+/!?#

requested_expiryinteger

Requested expiration of the authentication request in seconds.

Default:600

request_contextstring

A stringify object that contains more data about the request

example of object:

{
	"channel": "email", 
	"login_hint_type": "email", 
	"custom_message": "click on the following link to approve the access: "
}

Note: You should stringify the value.

property	description
channel	The channel to use for triggering the authentication device, one of the values: `sms` (default), `email`, `link`
login_hint_type	The `login_hint` identifier type, one of the values: `phone` (default), `email`, `user_id`
custom_message	Custom message to be sent when triggering the authentication device (default: `To verify it's you, click this link:`)

Example:"{\"channel\": \"email\", \"login_hint_type\": \"email\", \"custom_message\": \"click on the following link to approve the access: \"}"

curl -i -X POST \
  https://api.sbx.transmitsecurity.io/cis/oidc/backchannel \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d client_id=string \
  -d client_secret=string \
  -d scope=openid \
  -d login_hint=string \
  -d binding_message=string \
  -d requested_expiry=600 \
  -d 'request_context={"channel": "email", "login_hint_type": "email", "custom_message": "click on the following link to approve the access: "}'

Responses

The authentication request has been accepted

Bodyapplication/json

auth_req_idstringrequired

A unique identifier of the authentication request.

expires_inintegerrequired

A positive integer value indicating the expiration time of the auth_req_id in seconds since the authentication request was received

Default:600

Response

{
  "auth_req_id": "string",
  "expires_in": 600
}