Resource Owner

User Agent

Client

302 AuthServer: CLIENTID, CLIENTURL, SCOPE, CLIENTSTATE, CHALLENGE

Authz Server

Resource Server

VERIFIER = SECURE RNG() CHALLENGE = SHA256(VERIFIER)

POST /auth CLIENTID, CLIENTURL, SCOPE, CLIENTSTATE, CHALLENGE

prompt to login

signing in

asking for consent

yes! 302 CLIENTURL: AUTHCODE, CLIENTSTATE POST /cb AUTHCODE, CLIENTSTATE

AUTHCODE, VERIFIER

?

CHALLENGE = SHA256(VERIFIER) 200 OK: ACCESSTOKEN