CIBA — Client-Initiated Backchannel Authentication

OpenID Connect Client-Initiated Backchannel Authentication Flow

Configuration
CIBA Flow
1
CLIENT APP

Initiate Backchannel Authentication

Send a backchannel authentication request with the user's login hint. The authorization server will authenticate the user out-of-band (e.g., via push notification).

/oauth2/default/v1/bc-authorize
Configuration
/oauth2/default/v1/
Configure Okta Domain and Authorization Server to load scopes
cURL Command 

          

            Explain cURL
            |
            regenerate curl
          

        

        
        

      


      
      

        

          2
          

            CLIENT APP
            
Poll for Token

            
Poll the token endpoint with the auth_req_id until the user approves the authentication request.

            

              /oauth2/default/v1/token
              grant_type=urn:openid:params:grant-type:ciba
            

          

          
        

        

          cURL Command
          

          

            Explain cURL
            |
            regenerate curl
          

        

        

        
        
        
        
      


      
      

        

          3
          

            CLIENT APP
            Optional
            
Test Token with API

            
Test the access token by making an authenticated API request to a resource server.

          

          
        

        

          

            
            
          

          

            
            
          

        

        

          cURL Command
          

          

            Explain cURL
            |
            regenerate curl