Authentication (OAuth 2.0 + PKCE)

INFRA uses standard OAuth 2.0 with PKCE (Proof Key for Code Exchange) for all authorization flows. No proprietary SDK required.

PKCE flow#

1. Generate PKCE Pair — Create a cryptographically random code_verifier (43-128 chars). Derive code_challenge = BASE64URL(SHA256(code_verifier)).
2. Authorization Request — Redirect user to https://auth.infraidentity.com/oauth2/auth with response_type=code, scopes, state, and code_challenge.
3. User Consent — INFRA shows the user a consent screen listing the requested scopes. User approves or denies.
4. Authorization Code — INFRA redirects to your redirect_uri with ?code=AUTH_CODE&state=YOUR_STATE.
5. Token Exchange — Your backend POSTs to /oauth2/token with the code, code_verifier, client credentials. Receives access_token + refresh_token.
6. API Calls — Use the access_token as a Bearer token in the Authorization header for all INFRA API requests.

Scopes#

Token lifetimes#