OAuth 2.0 flow

User registration, authorization request, token exchange, and refresh token — the OAuth 2.0 Authorization Code Flow with PKCE.

User registration

Initiates user registration. The user receives a verification code via email or SMS and is redirected to the specified redirect_uri with an authorization code.

HTTP

Request

POST https://auth.enbox.net/register
Content-Type: application/x-www-form-urlencoded

response_type=code
&client_id=myapp-client-id
&redirect_uri=https://myapp.com/callback
&scope=profile email
&phone=+1234567890
&code_challenge=g91XPJpIt0PoaQXs2OEImlMdL_LGgH5HLrYxT-Ug5hk
&code_challenge_method=S256

Body parameters

Parameter	Type	Required	Description
client_id	string	✅	The application’s Client ID
redirect_uri	string	✅	The callback URL after registration
response_type	string	✅	Must be "code"
scope	string	✅	Requested permissions (e.g. "profile email")
phone / email	string	✅	User’s email or phone number
code_challenge	string	✅	PKCE Code Challenge (SHA-256 of code_verifier)
code_challenge_method	string	✅	"S256" (SHA-256 hashing method)

Response

302 Found
Location: https://myapp.com/callback?code=AUTH_CODE

Authorization request

Starts the OAuth 2.0 authorization process. The user is redirected to this URL, logs in, and authorizes the application.

HTTP

Request

GET https://auth.enbox.net/authorize
    ?response_type=code
    &client_id=myapp-client-id
    &redirect_uri=https://myapp.com/callback
    &scope=profile email
    &state=randomstring
    &code_challenge=g91XPJpIt0PoaQXs2OEImlMdL_LGgH5HLrYxT-Ug5hk
    &code_challenge_method=S256

Query parameters

Parameter	Type	Required	Description
response_type	string	✅	Must be "code"
client_id	string	✅	The application’s Client ID
redirect_uri	string	✅	The callback URL after authorization
scope	string	✅	Requested permissions (e.g. "profile email")
state	string	✅	Random string for CSRF protection
code_challenge	string	✅	PKCE Code Challenge (SHA-256 of code_verifier)
code_challenge_method	string	✅	"S256" (SHA-256 hashing method)

Response

302 Found
Location: https://myapp.com/callback?code=AUTH_CODE&state=randomstring

Token exchange

Exchanges an authorization code for an access token. The request must also include the verification code sent via email/SMS.

HTTP

Request

POST https://auth.enbox.net/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&client_id=myapp-client-id
&code=AUTH_CODE
&redirect_uri=https://myapp.com/callback
&code_verifier=randomstringxyz123456789
&verification_code=735291

Body parameters

Parameter	Type	Required	Description
grant_type	string	✅	Must be "authorization_code"
client_id	string	✅	The application’s Client ID
code	string	✅	Authorization code received from /authorize
redirect_uri	string	✅	Must match the value in the authorization request
code_verifier	string	✅	Original random string used for PKCE
verification_code	string	✅	Code received in email/SMS

Response

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "refresh-token-xyz"
}

Refresh token

Use a refresh token to obtain a new access token.

HTTP

Request

POST https://auth.enbox.net/token
Content-Type: application/x-www-form-urlencoded

grant_type=refresh_token
&client_id=myapp-client-id
&refresh_token=refresh-token-xyz

Body parameters

Parameter	Type	Required	Description
grant_type	string	✅	Must be "refresh_token"
client_id	string	✅	The application’s Client ID
refresh_token	string	✅	The refresh token received earlier

Response

{
  "access_token": "new-access-token",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "new-refresh-token"
}