AIVA Authorization

# Use the service address provided when your integration is registered.
AIVA_AUTH_URL='YOUR_ISSUED_AUTHORIZATION_SERVICE_URL'
curl --fail-with-body "${AIVA_AUTH_URL%/}/.well-known/openid-configuration"

$serviceUrl = 'YOUR_ISSUED_AUTHORIZATION_SERVICE_URL'
$metadata = Invoke-RestMethod "$($serviceUrl.TrimEnd('/'))/.well-known/openid-configuration"
$metadata.issuer
$metadata.authorization_endpoint
$metadata.token_endpoint
$metadata.code_challenge_methods_supported

using System.Text.Json;

using var http = new HttpClient();
var serviceUrl = "YOUR_ISSUED_AUTHORIZATION_SERVICE_URL";
using var discovery = JsonDocument.Parse(await http.GetStringAsync($"{serviceUrl.TrimEnd('/')}/.well-known/openid-configuration"));
var metadata = discovery.RootElement;

Console.WriteLine(metadata.GetProperty("issuer").GetString());
Console.WriteLine(metadata.GetProperty("authorization_endpoint").GetString());
Console.WriteLine(metadata.GetProperty("token_endpoint").GetString());
Console.WriteLine(string.Join(", ", metadata.GetProperty("code_challenge_methods_supported").EnumerateArray().Select(x => x.GetString())));

HTTP GET AUTHORIZATION_ENDPOINT_FROM_DISCOVERY?response_type=code
  &client_id=YOUR_CLIENT_ID
  &redirect_uri=https%3A%2F%2Fintegration.example.com%2Foauth%2Fcallback
  &scope=openid%20api%20resources.read%20offline_access
  &code_challenge=BASE64URL_SHA256_OF_VERIFIER
  &code_challenge_method=S256
  &state=RANDOM_SESSION_BOUND_VALUE

HTTP/1.1 302 Found
Location: https://integration.example.com/oauth/callback?code=ONE_TIME_CODE&state=RANDOM_SESSION_BOUND_VALUE

// First compare the returned state with the one stored for this login attempt.
// Exchange the code server-side; it is short-lived and cannot be redeemed twice.

using System.Security.Cryptography;
using System.Text;

static string Base64Url(byte[] bytes) => Convert.ToBase64String(bytes).TrimEnd('=').Replace('+', '-').Replace('/', '_');

var verifier = Base64Url(RandomNumberGenerator.GetBytes(32));
var challenge = Base64Url(SHA256.HashData(Encoding.ASCII.GetBytes(verifier)));
var state = Base64Url(RandomNumberGenerator.GetBytes(32));

// Store verifier + state against the user's login attempt in server-side session state.
var parameters = new Dictionary<string, string>
{
    ["response_type"] = "code",
    ["client_id"] = "YOUR_CLIENT_ID",
    ["redirect_uri"] = "https://integration.example.com/oauth/callback",
    ["scope"] = "openid api resources.read offline_access",
    ["code_challenge"] = challenge,
    ["code_challenge_method"] = "S256",
    ["state"] = state
};

var query = string.Join("&", parameters.Select(p => $"{Uri.EscapeDataString(p.Key)}={Uri.EscapeDataString(p.Value)}"));
var authorizationEndpoint = "AUTHORIZATION_ENDPOINT_FROM_DISCOVERY";
var authorizeUrl = $"{authorizationEndpoint}?{query}";
// Redirect the user's browser to authorizeUrl. Never send the client secret to the browser.

# Requires OpenSSL. Run on your trusted backend or development machine.
base64url() { openssl base64 -A | tr '+/' '-_' | tr -d '='; }
verifier=$(openssl rand 32 | base64url)
challenge=$(printf '%s' "$verifier" | openssl dgst -sha256 -binary | base64url)
state=$(openssl rand 32 | base64url)
# Keep verifier and state in the initiating user's server-side session.

# PowerShell 7 (pwsh)
function ConvertTo-Base64Url([byte[]]$bytes) {
    [Convert]::ToBase64String($bytes).TrimEnd('=').Replace('+', '-').Replace('/', '_')
}
$verifier = ConvertTo-Base64Url ([Security.Cryptography.RandomNumberGenerator]::GetBytes(32))
$challenge = ConvertTo-Base64Url ([Security.Cryptography.SHA256]::HashData([Text.Encoding]::ASCII.GetBytes($verifier)))
$state = ConvertTo-Base64Url ([Security.Cryptography.RandomNumberGenerator]::GetBytes(32))
# Keep verifier and state in the initiating user's server-side session.

# TOKEN_ENDPOINT is the token_endpoint value from discovery.
TOKEN_ENDPOINT='TOKEN_ENDPOINT_FROM_DISCOVERY'
curl --fail-with-body --request POST \
  --url "$TOKEN_ENDPOINT" \
  --user 'YOUR_CLIENT_ID:YOUR_CLIENT_SECRET' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'grant_type=authorization_code' \
  --data-urlencode 'code=ONE_TIME_CODE' \
  --data-urlencode 'redirect_uri=https://integration.example.com/oauth/callback' \
  --data-urlencode 'code_verifier=ORIGINAL_VERIFIER'

# PowerShell 7 (pwsh)
$tokenEndpoint = 'TOKEN_ENDPOINT_FROM_DISCOVERY'
$clientId = 'YOUR_CLIENT_ID'
$clientSecret = $env:AIVA_CLIENT_SECRET
$basic = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes("${clientId}:${clientSecret}"))
$tokens = Invoke-RestMethod -Method Post -Uri $tokenEndpoint -Headers @{ Authorization = "Basic $basic" } `
    -ContentType 'application/x-www-form-urlencoded' -Body @{
        grant_type = 'authorization_code'
        code = 'ONE_TIME_CODE'
        redirect_uri = 'https://integration.example.com/oauth/callback'
        code_verifier = 'ORIGINAL_VERIFIER'
    }
# Store $tokens securely; do not print token values.

using System.Net.Http.Headers;
using System.Text;
using System.Text.Json;

var clientId = "YOUR_CLIENT_ID";
var clientSecret = Environment.GetEnvironmentVariable("AIVA_CLIENT_SECRET")!;
var tokenEndpoint = "TOKEN_ENDPOINT_FROM_DISCOVERY";
var callbackCode = "ONE_TIME_CODE";
var verifier = "ORIGINAL_VERIFIER";

using var http = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Post, tokenEndpoint)
{
    Content = new FormUrlEncodedContent(new Dictionary<string, string>
    {
        ["grant_type"] = "authorization_code",
        ["code"] = callbackCode,
        ["redirect_uri"] = "https://integration.example.com/oauth/callback",
        ["code_verifier"] = verifier
    })
};
request.Headers.Authorization = new AuthenticationHeaderValue("Basic", Convert.ToBase64String(Encoding.UTF8.GetBytes($"{clientId}:{clientSecret}")));
using var response = await http.SendAsync(request);
response.EnsureSuccessStatusCode();
using var tokens = JsonDocument.Parse(await response.Content.ReadAsStringAsync());
var accessToken = tokens.RootElement.GetProperty("access_token").GetString();
// Store tokens securely; do not log their values.

{
  "access_token": "REDACTED_SIGNED_JWT",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "REDACTED_PROTECTED_TOKEN",
  "scope": "openid api resources.read offline_access"
}

# TOKEN_ENDPOINT is the token_endpoint value from discovery.
TOKEN_ENDPOINT='TOKEN_ENDPOINT_FROM_DISCOVERY'
curl --fail-with-body --request POST \
  --url "$TOKEN_ENDPOINT" \
  --user 'YOUR_CLIENT_ID:YOUR_CLIENT_SECRET' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'grant_type=refresh_token' \
  --data-urlencode 'refresh_token=STORED_REFRESH_TOKEN'

# PowerShell 7 (pwsh)
$tokenEndpoint = 'TOKEN_ENDPOINT_FROM_DISCOVERY'
$clientId = 'YOUR_CLIENT_ID'
$clientSecret = $env:AIVA_CLIENT_SECRET
$refreshToken = 'STORED_REFRESH_TOKEN'
$basic = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes("${clientId}:${clientSecret}"))
$tokens = Invoke-RestMethod -Method Post -Uri $tokenEndpoint -Headers @{ Authorization = "Basic $basic" } `
    -ContentType 'application/x-www-form-urlencoded' -Body @{
        grant_type = 'refresh_token'
        refresh_token = $refreshToken
    }
$accessToken = $tokens.access_token
$expiresAt = [DateTimeOffset]::UtcNow.AddSeconds($tokens.expires_in)
if ($tokens.refresh_token) { $refreshToken = $tokens.refresh_token } # Persist replacement securely.

using System.Net.Http.Headers;
using System.Text;
using System.Text.Json;

var tokenEndpoint = "TOKEN_ENDPOINT_FROM_DISCOVERY";
var clientId = "YOUR_CLIENT_ID";
var clientSecret = Environment.GetEnvironmentVariable("AIVA_CLIENT_SECRET")!;
var refreshToken = "STORED_REFRESH_TOKEN";

using var http = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Post, tokenEndpoint)
{
    Content = new FormUrlEncodedContent(new Dictionary<string, string>
    {
        ["grant_type"] = "refresh_token",
        ["refresh_token"] = refreshToken
    })
};
request.Headers.Authorization = new AuthenticationHeaderValue("Basic", Convert.ToBase64String(Encoding.UTF8.GetBytes($"{clientId}:{clientSecret}")));
using var response = await http.SendAsync(request);
response.EnsureSuccessStatusCode();
using var tokens = JsonDocument.Parse(await response.Content.ReadAsStringAsync());
var accessToken = tokens.RootElement.GetProperty("access_token").GetString()!;
var expiresAt = DateTimeOffset.UtcNow.AddSeconds(tokens.RootElement.GetProperty("expires_in").GetInt32());
if (tokens.RootElement.TryGetProperty("refresh_token", out var replacement)) refreshToken = replacement.GetString()!;
// Securely persist the updated access token, expiry, and refresh token.

# Replace with an API endpoint approved for your integration.
AIVA_API_URL='YOUR_APPROVED_API_ENDPOINT'
ACCESS_TOKEN='YOUR_ACCESS_TOKEN'
curl --fail-with-body --header "Authorization: Bearer $ACCESS_TOKEN" "$AIVA_API_URL"

# PowerShell 7 (pwsh)
$apiUrl = 'YOUR_APPROVED_API_ENDPOINT'
$accessToken = 'YOUR_ACCESS_TOKEN'
$result = Invoke-RestMethod -Uri $apiUrl -Headers @{ Authorization = "Bearer $accessToken" }

using System.Net.Http.Headers;

var apiUrl = "YOUR_APPROVED_API_ENDPOINT";
var accessToken = "YOUR_ACCESS_TOKEN";
using var http = new HttpClient();
http.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
using var response = await http.GetAsync(apiUrl);
response.EnsureSuccessStatusCode();

# Bash; requires curl, jq and openssl. Run from your trusted backend/dev machine.
AIVA_AUTH_URL='YOUR_ISSUED_AUTHORIZATION_SERVICE_URL'
AIVA_CLIENT_ID='YOUR_CLIENT_ID'
AIVA_CLIENT_SECRET='YOUR_CLIENT_SECRET' # Demo only: use secure secret storage.
AIVA_API_URL='YOUR_APPROVED_API_ENDPOINT'
REDIRECT_URI='https://integration.example.com/oauth/callback'

metadata=$(curl --fail-with-body -sS "${AIVA_AUTH_URL%/}/.well-known/openid-configuration")
authorize_endpoint=$(jq -r .authorization_endpoint <<< "$metadata")
token_endpoint=$(jq -r .token_endpoint <<< "$metadata")
base64url() { openssl base64 -A | tr '+/' '-_' | tr -d '='; }
urlencode() { jq -nr --arg text "$1" '$text | @uri'; }
verifier=$(openssl rand 32 | base64url)
challenge=$(printf '%s' "$verifier" | openssl dgst -sha256 -binary | base64url)
state=$(openssl rand 32 | base64url)

url="${authorize_endpoint}?response_type=code&client_id=$(urlencode "$AIVA_CLIENT_ID")&redirect_uri=$(urlencode "$REDIRECT_URI")&scope=$(urlencode 'openid api resources.read offline_access')&code_challenge=$challenge&code_challenge_method=S256&state=$state"
printf 'Open in your browser:\n%s\n' "$url"
# Complete AIVA login in the browser. Read code and state from the callback URL.
read -r -p 'Returned code: ' code
read -r -p 'Returned state: ' returned_state
[ "$returned_state" = "$state" ] || { echo 'State mismatch' >&2; exit 1; }

tokens=$(curl --fail-with-body -sS --user "$AIVA_CLIENT_ID:$AIVA_CLIENT_SECRET" \
  --data-urlencode 'grant_type=authorization_code' --data-urlencode "code=$code" \
  --data-urlencode "redirect_uri=$REDIRECT_URI" --data-urlencode "code_verifier=$verifier" "$token_endpoint")
access_token=$(jq -r .access_token <<< "$tokens")
refresh_token=$(jq -r .refresh_token <<< "$tokens")
# Use the token according to your API's authentication contract.
curl --fail-with-body -sS -H "Authorization: Bearer $access_token" "$AIVA_API_URL"

updated=$(curl --fail-with-body -sS --user "$AIVA_CLIENT_ID:$AIVA_CLIENT_SECRET" \
  --data-urlencode 'grant_type=refresh_token' --data-urlencode "refresh_token=$refresh_token" "$token_endpoint")
access_token=$(jq -r .access_token <<< "$updated")
refresh_token=$(jq -r --arg old "$refresh_token" '.refresh_token // $old' <<< "$updated")
printf 'New access token expires in %s seconds.\n' "$(jq -r .expires_in <<< "$updated")"
# Persist the refreshed tokens securely; never log their values.

# PowerShell 7 (pwsh). Demo uses interactive callback values.
$serviceUrl = 'YOUR_ISSUED_AUTHORIZATION_SERVICE_URL'
$clientId = 'YOUR_CLIENT_ID'
$clientSecret = $env:AIVA_CLIENT_SECRET
$apiUrl = 'YOUR_APPROVED_API_ENDPOINT'
$redirectUri = 'https://integration.example.com/oauth/callback'
$metadata = Invoke-RestMethod "$($serviceUrl.TrimEnd('/'))/.well-known/openid-configuration"

function ConvertTo-Base64Url([byte[]]$bytes) {
    [Convert]::ToBase64String($bytes).TrimEnd('=').Replace('+', '-').Replace('/', '_')
}
$verifier = ConvertTo-Base64Url ([Security.Cryptography.RandomNumberGenerator]::GetBytes(32))
$challenge = ConvertTo-Base64Url ([Security.Cryptography.SHA256]::HashData([Text.Encoding]::ASCII.GetBytes($verifier)))
$state = ConvertTo-Base64Url ([Security.Cryptography.RandomNumberGenerator]::GetBytes(32))
$authorizeUrl = "$($metadata.authorization_endpoint)?response_type=code&client_id=$([uri]::EscapeDataString($clientId))&redirect_uri=$([uri]::EscapeDataString($redirectUri))&scope=$([uri]::EscapeDataString('openid api resources.read offline_access'))&code_challenge=$challenge&code_challenge_method=S256&state=$state"
Write-Host "Open in your browser: $authorizeUrl"
$code = Read-Host 'Returned code'
$returnedState = Read-Host 'Returned state'
if ($returnedState -cne $state) { throw 'State mismatch' }

$basic = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes("${clientId}:${clientSecret}"))
$headers = @{ Authorization = "Basic $basic" }
$tokens = Invoke-RestMethod -Method Post -Uri $metadata.token_endpoint -Headers $headers `
    -ContentType 'application/x-www-form-urlencoded' -Body @{
        grant_type = 'authorization_code'; code = $code
        redirect_uri = $redirectUri; code_verifier = $verifier
    }
$accessToken = $tokens.access_token
$refreshToken = $tokens.refresh_token
# The chosen API may require additional headers beyond this bearer-token example.
Invoke-RestMethod -Uri $apiUrl -Headers @{ Authorization = "Bearer $accessToken" }

$updated = Invoke-RestMethod -Method Post -Uri $metadata.token_endpoint -Headers $headers `
    -ContentType 'application/x-www-form-urlencoded' -Body @{
        grant_type = 'refresh_token'; refresh_token = $refreshToken
    }
$accessToken = $updated.access_token
if ($updated.refresh_token) { $refreshToken = $updated.refresh_token }
$expiresAt = [DateTimeOffset]::UtcNow.AddSeconds($updated.expires_in)
Write-Host "Refreshed access token expires (UTC): $expiresAt"
# Persist the refreshed tokens securely; never log their values.

// .NET 10 console example: BCL only; browser login is performed interactively.
using System.Net.Http.Headers;
using System.Security.Cryptography;
using System.Text;
using System.Text.Json;

var serviceUrl = "YOUR_ISSUED_AUTHORIZATION_SERVICE_URL";
var clientId = "YOUR_CLIENT_ID";
var clientSecret = Environment.GetEnvironmentVariable("AIVA_CLIENT_SECRET")!;
var apiUrl = "YOUR_APPROVED_API_ENDPOINT";
var redirectUri = "https://integration.example.com/oauth/callback";
using var http = new HttpClient();
using var discovery = JsonDocument.Parse(await http.GetStringAsync($"{serviceUrl.TrimEnd('/')}/.well-known/openid-configuration"));
var authorizationEndpoint = discovery.RootElement.GetProperty("authorization_endpoint").GetString()!;
var tokenEndpoint = discovery.RootElement.GetProperty("token_endpoint").GetString()!;

static string Base64Url(byte[] value) => Convert.ToBase64String(value).TrimEnd('=').Replace('+', '-').Replace('/', '_');
var verifier = Base64Url(RandomNumberGenerator.GetBytes(32));
var challenge = Base64Url(SHA256.HashData(Encoding.ASCII.GetBytes(verifier)));
var state = Base64Url(RandomNumberGenerator.GetBytes(32));
var query = new Dictionary<string, string>
{
    ["response_type"] = "code", ["client_id"] = clientId, ["redirect_uri"] = redirectUri,
    ["scope"] = "openid api resources.read offline_access", ["code_challenge"] = challenge,
    ["code_challenge_method"] = "S256", ["state"] = state
};
var authorizeUrl = $"{authorizationEndpoint}?{string.Join("&", query.Select(p => $"{Uri.EscapeDataString(p.Key)}={Uri.EscapeDataString(p.Value)}"))}";
Console.WriteLine($"Open in your browser: {authorizeUrl}");
Console.Write("Returned code: ");
var code = Console.ReadLine()!;
Console.Write("Returned state: ");
if (Console.ReadLine() != state) throw new InvalidOperationException("State mismatch");

async Task<JsonDocument> RequestTokensAsync(Dictionary<string, string> form)
{
    using var request = new HttpRequestMessage(HttpMethod.Post, tokenEndpoint) { Content = new FormUrlEncodedContent(form) };
    request.Headers.Authorization = new AuthenticationHeaderValue("Basic", Convert.ToBase64String(Encoding.UTF8.GetBytes($"{clientId}:{clientSecret}")));
    using var response = await http.SendAsync(request);
    response.EnsureSuccessStatusCode();
    return JsonDocument.Parse(await response.Content.ReadAsStringAsync());
}

using var tokens = await RequestTokensAsync(new()
{
    ["grant_type"] = "authorization_code", ["code"] = code,
    ["redirect_uri"] = redirectUri, ["code_verifier"] = verifier
});
var accessToken = tokens.RootElement.GetProperty("access_token").GetString()!;
var refreshToken = tokens.RootElement.GetProperty("refresh_token").GetString()!;
using var apiRequest = new HttpRequestMessage(HttpMethod.Get, apiUrl);
apiRequest.Headers.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
using var apiResponse = await http.SendAsync(apiRequest);
apiResponse.EnsureSuccessStatusCode(); // Follow your API's own authentication contract.

using var updated = await RequestTokensAsync(new()
{
    ["grant_type"] = "refresh_token", ["refresh_token"] = refreshToken
});
accessToken = updated.RootElement.GetProperty("access_token").GetString()!;
if (updated.RootElement.TryGetProperty("refresh_token", out var replacement)) refreshToken = replacement.GetString()!;
var expiresAt = DateTimeOffset.UtcNow.AddSeconds(updated.RootElement.GetProperty("expires_in").GetInt32());
Console.WriteLine($"Refreshed access token expires (UTC): {expiresAt:u}");
// In a real web app, persist state/verifier and tokens in secure server-side storage.

{
  "error": "invalid_grant",
  "error_description": "The token is no longer valid."
}