Acquire Authorization Code (Cross-Domain)

• Requires an existing access token (Bearer authentication)
• Does NOT send a passwordless email
• Immediately returns an authorization code
• Is designed for cross-domain authentication transfers

​

Use Cases

• Cross-domain authentication (e.g., rewards.thanx.com → order.thanx.com)
• Single sign-on flows where the user is already authenticated
• Mobile app to web transitions

​

Security Considerations

• Codes expire in 10 minutes
• Codes are single-use only
• Requires valid access token for the target user
• redirect_uri must be whitelisted for your integration

curl https://api.thanxsandbox.com/oauth/authorize-cross-domain \
  -X POST \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "client_id": "f4bf04a6fc27b5fa926a7318933b76440642c25cde037d8e867b3d18d771ad86",
    "redirect_uri": "https://order.example.com/merchant-handle/passwordless-login",
    "response_type": "code",
    "scope": "passwordless"
  }'

{
  "code": "def50200a8d9c3f2e1b4a7c6d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0",
  "expires_in": 600,
  "redirect_uri": "https://order.example.com/merchant-handle/passwordless-login"
}

{
  "error": "access_denied",
  "error_description": "The access token is invalid or has expired."
}

{
  "error": "invalid_redirect_uri",
  "error_description": "The redirect uri included is not valid."
}

​

Request

​

Response