← Customer API home

Cognito OAuth authorization code + PKCE

Use this flow when a user delegates access to a third-party application. Personal access tokens and service tokens remain available for direct and server-to-server integrations.

Before you start

  1. Register the app client, exact redirect URI, and least-privilege scopes with SmartPublisher.
  2. Store the app's client_id. Public PKCE clients do not store a client secret.
  3. Generate a fresh random state and PKCE verifier for every authorization request.

1. Authorize the user

GET https://auth.smartpublisher.com/oauth2/authorize
  ?response_type=code
  &client_id=<client-id>
  &redirect_uri=<registered-redirect-uri>
  &scope=openid%20smartpublisher-api/accounts:read
  &resource=https%3A%2F%2Fapi.smartpublisher.com%2Fcustomer-api%2Fv1
  &state=<random-state>
  &code_challenge=<base64url-sha256-verifier>
  &code_challenge_method=S256

Verify the returned state before exchanging the code. Amazon Cognito supports only S256 for PKCE.

2. Exchange the code

POST https://auth.smartpublisher.com/oauth2/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&client_id=<client-id>
&code=<authorization-code>
&redirect_uri=<registered-redirect-uri>
&code_verifier=<original-verifier>

3. Call the customer API

GET https://api.smartpublisher.com/customer-api/v1/accounts
Authorization: Bearer <access-token>

The API validates signature, issuer, expiry, resource audience, app registration, tenant membership, and scopes. ID tokens are rejected.

Scopes

Request only the scopes your app needs. Cognito scopes use the smartpublisher-api/ prefix; the full list is in the OpenAPI reference.

References