{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"redocly_category":"Journeys","product":"Identity Management","type":"markdown"},"seo":{"title":"Journey completion for SDK journeys","description":"Everything about Mosaic Journeys, SDKs, and APIs","siteUrl":"https://developer.transmitsecurity.com/","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"journey-completion-for-sdk-journeys","__idx":0},"children":["Journey completion for SDK journeys"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For journeys implemented with the Orchestration SDK, completion is determined by the terminal SDK response: ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Success"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Rejection"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For journeys involving user authentication steps, successful completion can initiate a backend token exchange flow. In this model, your client receives an opaque code and passes it to your backend. Your backend then exchanges the opaque code with Mosaic in a server-to-server call to obtain the user access token together with enriched context. This is the recommended mode when you do not want Mosaic user tokens to pass through the client and you want the backend to receive the token directly. It lets you:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["keep user access tokens off the client"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["establish session or backend trust using the backend"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["align journey orchestration with a more secure token delivery pattern"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["use Mosaic capabilities that depend on the backend receiving the access token directly, such as ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/token_signing_keys#bring-your-own-key-byok"},"children":["BYOK"]}]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Journeys without authentication"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Not every successful journey produces a user token flow. If the journey completes successfully but does not authenticate the user, treat ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Success"]}," as the final orchestration result and do not expect a user access token."]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":"Using the legacy journey token"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This page describes the current SDK journey completion model. Some older integrations still rely on the legacy journey token returned upon successful completion. If your integration depends on that additional legacy artifact, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/getting-started/journey_token"},"children":["Journey token"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"how-it-works","__idx":1},"children":["How it works"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The Orchestration SDK returns the terminal result. For journeys involving user authentication steps, a successful completion returns an opaque code. Your client passes that code to your backend, which exchanges it with Mosaic using ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["POST /ido/api/v2/token/exchange?clientId=[YOUR_CLIENT_ID]"]},". Your backend then uses the returned user tokens and enriched context to establish the application session or run other business logic."]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"sequenceDiagram\n participant SDK as Orchestration SDK\n participant C as Your client\n participant M as Mosaic\n participant B as Your backend\n\n SDK-->>C: Return journey result: Success or Rejection\n\n alt Success with authentication\n C->>B: Send opaque code\n B->>M: POST /ido/api/v2/token/exchange?clientId=[YOUR_CLIENT_ID] with code + journeyId\n M-->>B: Return user tokens and enriched context\n B-->>B: Run your business logic\n else Rejection or Success with no authentication\n end\n","diagramHtml":"Your backendMosaicYour clientOrchestration SDKYour backendMosaicYour clientOrchestration SDKalt[Success with authentication][Rejection or Success with no authentication]Return journey result: Success or RejectionSend opaque codePOST /ido/api/v2/token/exchange?clientId=[YOUR_CLIENT_ID] with code + journeyIdReturn user tokens and enriched contextRun your business logic","diagramHtmlDark":"Your backendMosaicYour clientOrchestration SDKYour backendMosaicYour clientOrchestration SDKalt[Success with authentication][Rejection or Success with no authentication]Return journey result: Success or RejectionSend opaque codePOST /ido/api/v2/token/exchange?clientId=[YOUR_CLIENT_ID] with code + journeyIdReturn user tokens and enriched contextRun your business logic"},"children":["sequenceDiagram\n participant SDK as Orchestration SDK\n participant C as Your client\n participant M as Mosaic\n participant B as Your backend\n\n SDK-->>C: Return journey result: Success or Rejection\n\n alt Success with authentication\n C->>B: Send opaque code\n B->>M: POST /ido/api/v2/token/exchange?clientId=[YOUR_CLIENT_ID] with code + journeyId\n M-->>B: Return user tokens and enriched context\n B-->>B: Run your business logic\n else Rejection or Success with no authentication\n end\n"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"opaque-code-behavior","__idx":2},"children":["Opaque code behavior"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The opaque code is a short-lived, one-time-use exchange credential."]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["the code expires after a short time, up to 5 minutes"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["the code can be used only once"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["after a successful exchange, the code cannot be reused"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This means your backend should exchange the code immediately after receiving it from the client."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"backend-token-exchange-requirements","__idx":3},"children":["Backend token exchange requirements"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To use backend token exchange:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["the journey includes an authentication step"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["your backend calls the exchange endpoint"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["the backend client is assigned the required ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Journey Code Exchange (Write)"]}," permission. In Mosaic, configure this access by creating or editing a client role under ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Applications"]}," > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client roles"]},", enabling ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Authentication"]}," > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Authentication"]}," > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Journey Code Exchange (Write)"]},", and then assigning that role to the backend client under ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Applications"]}," > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["your app"]}," > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Clients"]},". Client roles can only be assigned to first-party app clients. For more details, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/manage_client_roles"},"children":["Manage client roles"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["only a client with that permission on the same ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["appId"]}," can consume the opaque code"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["treat the SDK completion response as the orchestration outcome, and the backend exchange as the authentication outcome"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For SDK integration details, see the quickstarts for ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/getting-started/quick_start_web"},"children":["Web"]},", ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/getting-started/quick_start_ios"},"children":["iOS"]},", ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/getting-started/quick_start_android"},"children":["Android"]},", and ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/getting-started/quick_start_react_native"},"children":["React Native"]},". For user token validation, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/validate_tokens"},"children":["Validate tokens"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"token-exchange-api","__idx":4},"children":["Token Exchange API"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Endpoint Name:"]}," Token Exchange API ",{"$$mdtype":"Tag","name":"br","attributes":{},"children":[]}," ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Description:"]}," Exchanges a one-time opaque code generated upon successful authenticated journey completion for Mosaic user tokens. The code is bound to the journey and application, has a short lifetime, and is consumed on use."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Base URL:"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://api.transmitsecurity.io"]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Base URL options"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The base URL can vary depending on your environment:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Production regions"]},": ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["api.transmitsecurity.io"]}," (US), ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["api.eu.transmitsecurity.io"]}," (EU), ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["api.ca.transmitsecurity.io"]}," (Canada), ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["api.au.transmitsecurity.io"]}," (Australia)"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Sandbox"]},": ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["api.sbx.transmitsecurity.io"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Custom domain"]},": If you're using a ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/deployment/custom_domains"},"children":["custom domain"]}," for your Mosaic application, replace the host in the base URL with your custom domain."]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"endpoint","__idx":5},"children":["Endpoint"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Method:"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["POST"]}," ",{"$$mdtype":"Tag","name":"br","attributes":{},"children":[]}," ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["URL:"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/ido/api/v2/token/exchange?clientId=[YOUR_CLIENT_ID]"]}," ",{"$$mdtype":"Tag","name":"br","attributes":{},"children":[]}," ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Authentication Required:"]}," Yes"]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Client ID query parameter"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["clientId"]},", use the Client ID from the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://portal.transmitsecurity.io/applications/"},"children":["settings"]}," of the application running the journey. This ensures the request is routed to the correct application."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"authentication","__idx":6},"children":["Authentication"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Authorize the request using a bearer token generated for the backend client. The token must contain:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["an ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["app_id"]}," claim"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["the permission ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["execute::auth-tokens"]}]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":"Different from the OIDC token endpoint"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This endpoint is different from the standard ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/user/oidc.openapi/other/oidctoken"},"children":["/oidc/token"]}," endpoint. Use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/oidc/token"]}," only to obtain the backend client's bearer token for authorizing the token exchange request."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To obtain this bearer token, generate a client access token using the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/user/oidc.openapi/other/oidctoken"},"children":["/oidc/token"]}," endpoint with the backend client credentials. You can find the backend client's Client ID and Client Secret in the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Admin Portal"]}," > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Applications"]}," > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["your app"]}," > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Clients"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Headers Required:"]}]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Content-Type: application/json"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Authorization: Bearer "]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"example-request","__idx":7},"children":["Example request"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"curl -X POST \\\n \"https://api.sbx.transmitsecurity.io/ido/api/v2/token/exchange?clientId=\" \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer \" \\\n -d '{\n \"code\": \"OPAQUE_CODE\",\n \"journeyId\": \"JOURNEY_ID\"\n }'\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"request-parameters","__idx":8},"children":["Request parameters"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Parameter"},"children":["Parameter"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Type"},"children":["Type"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Required"},"children":["Required"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["clientId"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["string"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Query string parameter containing the Client ID of the application running the journey"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["code"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["string"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["One-time opaque code returned after successful authenticated journey completion"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["journeyId"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["string"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Identifier of the journey that generated the code"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Authorization"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["string"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Bearer token for the backend client. Must contain an ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["app_id"]}," claim and the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["execute::auth-tokens"]}," permission"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"response","__idx":9},"children":["Response"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"successful-response-status-code-200-ok-","__idx":10},"children":["Successful response (Status code: ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["200 OK"]},")"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A successful response contains user tokens and a session identifier, for example:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n \"access_token\": \"ACCESS_TOKEN\",\n \"id_token\": \"ID_TOKEN\",\n \"refresh_token\": \"REFRESH_TOKEN\",\n \"session_id\": \"SESSION_ID\"\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The returned ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["access_token"]}," is a JWT access token that includes IDO-specific custom claims under ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["custom_claims.ido"]},", including:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["journey_id"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["session_id"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["invocation_id"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["correlation_id"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["journey_name"]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"successful-response-fields","__idx":11},"children":["Successful response fields"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Field Name"},"children":["Field Name"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Type"},"children":["Type"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["access_token"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["string"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["JWT access token enriched with IDO-specific custom claims under ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["custom_claims.ido"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["id_token"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["string"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["OpenID Connect ID token"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["refresh_token"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["string"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["OAuth 2.0 refresh token"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["session_id"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["string"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Server-side session identifier"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"error-response--400-bad-request-","__idx":12},"children":["Error response (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["400 Bad Request"]},")"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n \"error_code\": 5007,\n \"message\": \"invalid_grant\"\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Returned when the code is invalid, expired, already consumed, or does not match the supplied ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["journeyId"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"error-response--401-unauthorized-","__idx":13},"children":["Error response (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["401 Unauthorized"]},")"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n \"error_code\": 5001,\n \"message\": \"Bad credentials provided, appId not found in token claims\"\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Returned when the bearer token is missing or invalid, when the token does not include an ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["app_id"]}," claim, or when the backend client is missing the required permission."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"legacy-journey-token","__idx":14},"children":["Legacy journey token"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The behavior described above is the current SDK journey completion model for authenticated journeys."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If your tenant still uses the legacy journey token behavior, check the global ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Return journey token on completion"]}," setting under ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["B2B"]}," or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["B2C Identity"]}," (based on your implementation) > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Identity Journeys"]}," > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Journey settings"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For existing tenants, this setting is enabled by default to preserve backward compatibility. For new tenants, this setting is disabled by default."]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["if the setting is enabled, successful journey completion returns a journey token in addition to the opaque code and any user access tokens issued after successful authentication"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["if you disable the setting, the legacy journey token is no longer returned"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The setting does not control whether authenticated journeys return the opaque code. For successful journeys with an authentication step, the opaque code is returned regardless of whether this setting is enabled."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The journey token is a legacy completion artifact. It does not include OIDC access tokens or ID tokens."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For details about the legacy behavior, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/getting-started/journey_token"},"children":["Journey token"]},"."]}]},"headings":[{"value":"Journey completion for SDK journeys","id":"journey-completion-for-sdk-journeys","depth":1},{"value":"How it works","id":"how-it-works","depth":2},{"value":"Opaque code behavior","id":"opaque-code-behavior","depth":2},{"value":"Backend token exchange requirements","id":"backend-token-exchange-requirements","depth":2},{"value":"Token Exchange API","id":"token-exchange-api","depth":2},{"value":"Endpoint","id":"endpoint","depth":3},{"value":"Authentication","id":"authentication","depth":3},{"value":"Example request","id":"example-request","depth":3},{"value":"Request parameters","id":"request-parameters","depth":3},{"value":"Response","id":"response","depth":3},{"value":"Successful response (Status code: 200 OK )","id":"successful-response-status-code-200-ok-","depth":4},{"value":"Successful response fields","id":"successful-response-fields","depth":4},{"value":"Error response ( 400 Bad Request )","id":"error-response--400-bad-request-","depth":4},{"value":"Error response ( 401 Unauthorized )","id":"error-response--401-unauthorized-","depth":4},{"value":"Legacy journey token","id":"legacy-journey-token","depth":2}],"frontmatter":{"markdown":{"toc":{"depth":2}},"seo":{"title":"Journey completion for SDK journeys"}},"lastModified":"2026-06-03T08:52:17.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/guides/orchestration/getting-started/journey_completion","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}