Create Authorization Code (V2)

Call this endpoint to create an authorization code using PKCE

Generate a verifier of 43–128 characters using only A-Z, a-z, 0-9, -, ., _ and ~. For example, in Node.js:

const crypto = require("crypto");
const codeVerifier = crypto.randomBytes(32).toString("base64url");
const codeChallenge = crypto.createHash("sha256").update(codeVerifier).digest("base64url");
const state = crypto.randomBytes(16).toString("hex");

The fixed challenge in the cURL example corresponds to the verifier shown on the Get SSO Access Token (V2) page. Generate a fresh pair for each login.

cURL

curl --request POST \
'https://test-api.bvndle.com/api/v2/ufel/users/authorization/authorization-code?scope=profile&deviceType=mobile' \
--header 'Content-Type: application/json' \
--data-raw '{
  "clientId": "<your-client-id>",
  "tag": "<user-tag>",
  "password": "<user-password>",
  "codeChallenge": "Zb25qaaHzAyaS5_YK9-tj0YcmNnggu0bjvutHn2-Js0",
  "codeChallengeMethod": "S256",
  "state": "7f3c9a1e5b2d48c6a0e1f4b7d9c23e68"
}'

Success

{
  "status": "success",
  "message": "RedirectUrl and authorization code fetched successfully",
  "data": {
    "redirectUrl": "https://google.com?authorization-code=GDTC1ZHSNSEO95QDXMCT&state=7f3c9a1e5b2d48c6a0e1f4b7d9c23e68"
  }
}

Continue with Get SSO Access Token (V2), sending the authorization code and original verifier.