curl https://api.thanxsandbox.com/oauth/authorize \
-X POST \
-H "Content-Type: application/json" \
-d '{
"client_id": "${client_id}",
"redirect_uri": "https://www.example.com/oauth/callback",
"response_type": "code",
"scope": "passwordless",
"username": "john.smith@example.com"
}'
""
{
"error": "access_denied",
"error_description": "The resource owner or authorization server denied the request."
}
{
"error": "invalid_redirect_uri",
"error_description": "The redirect uri included is not valid."
}
SSO
Acquire Authorization Code
This endpoint triggers the passwordless login flow.
POST
/
oauth
/
authorize
curl https://api.thanxsandbox.com/oauth/authorize \
-X POST \
-H "Content-Type: application/json" \
-d '{
"client_id": "${client_id}",
"redirect_uri": "https://www.example.com/oauth/callback",
"response_type": "code",
"scope": "passwordless",
"username": "john.smith@example.com"
}'
""
{
"error": "access_denied",
"error_description": "The resource owner or authorization server denied the request."
}
{
"error": "invalid_redirect_uri",
"error_description": "The redirect uri included is not valid."
}
Calling this endpoint will send a passwordless email to the email address
specified as the
Note that abitrary data can be passed through this authentication process by
using custom query parameters. For example, for the whitelisted
username. The response to this request will be a 200
and an empty response body. The passwordless email will contain a link to log
in which will redirect the user to the specified redirect_uri with the
authorization code included in the query params (?code=...).
The redirect_uri must be whitelisted for your integration by our developer
support team. If you need a URL added or changed, feel free to write to
developer.support@thanx.com.
redirect_uri is validated by exact string match. Register every URI you
use — including native custom-scheme deeplinks (yourscheme://magic,
yourscheme://open) verbatim and separately from your HTTPS web callbacks.
Registering only HTTPS callbacks makes native sign-in fail with
invalid_redirect_uri. Custom schemes are kept as-is — do not convert them to
https.redirect_uri
of https://www.example.com/oauth/callback, query parameters can be appended
to the URL and will be passed through the entire auth process. As an example,
https://www.example.com/oauth/callback?table=1 as the input redirect_uri to
the API request would preserve table=1. Note that the code value is a
reserved parameter that should not be used, as that will conflict with the
access code that will be appended to the redirect_uri.
If an account does not exist for the specified email, a 401 error will be
returned. To create an account, the POST /users
endpoint should be used.
curl https://api.thanxsandbox.com/oauth/authorize \
-X POST \
-H "Content-Type: application/json" \
-d '{
"client_id": "${client_id}",
"redirect_uri": "https://www.example.com/oauth/callback",
"response_type": "code",
"scope": "passwordless",
"username": "john.smith@example.com"
}'
""
{
"error": "access_denied",
"error_description": "The resource owner or authorization server denied the request."
}
{
"error": "invalid_redirect_uri",
"error_description": "The redirect uri included is not valid."
}