Start here · Step 5

Validate tokens and call UserInfo

Exchange the single-use authorization code from your backend, validate every token, and request only the information approved for this authorization.

Exchange the code

POST https://api.dev.unifyid.io/v1/oauth/token
Content-Type: application/json

{
  "grant_type": "authorization_code",
  "code": "{one_time_code}",
  "redirect_uri": "{registered_redirect_uri}",
  "client_id": "{client_id}",
  "code_verifier": "{original_pkce_verifier}",
  "client_secret": "{confidential_clients_only}"
}

Include client_secret only for a confidential backend. Browser and mobile clients must omit it and rely on S256 PKCE.

Validate before use

Verify the signature, issuer, audience, expiry, nonce, and token type. Never accept an ID token or access token solely because it can be decoded.

Request approved information

GET https://api.dev.unifyid.io/v1/userinfo
Authorization: Bearer {access_token}

UserInfo returns the pairwise subject and only claims approved in this authorization. Missing information is omitted rather than returned as an unverified value.

Storage boundary

Keep tokens on the backend where possible, encrypt stored tokens, use their shortest practical lifetime, and stop using data when authorization expires or is revoked.