Validity of Authorization Code

[Amal Antony]

Hi,

I want to know how long is the authorization code valid for getting Keycloak's access token. Is there any time limit for it or Is it for one time usage only.

Suppose we use the authorization code for getting an access token but the flow was not completed properly and resulted in failure. Can the same code be used again to get the access token. Will it result in success or will it show a failure message like "code not valid"?

It showed the error message when I tried it using Postman. I just wanted to confirm on this.

Regards,

Amal Antony

[Michal Hajas]

Hello Amal,

I believe this kind of question belongs to the keycloak-user group rather than keycloak-dev. Could you please use it for the following questions? See https://www.keycloak.org/community for more details.

To your question:

Yes, it should result in the message "code not valid". Authorization code is valid only for a very limited amount of time.

See the following for more details on authorization code flow:

https://www.keycloak.org/docs/latest/server_admin/index.html#_oidc-auth-flows-authorization

https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth

https://www.rfc-editor.org/rfc/rfc6749#section-1.3.1

Michal

--
You received this message because you are subscribed to the Google Groups "Keycloak Dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to keycloak-dev...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/keycloak-dev/2cc070b9-3ccb-4e15-84ef-5ba10f5e50b8n%40googlegroups.com.