Generate Authorization Code

curl --request POST \
  --url https://api.example.com/v1/auth/oauth/authorize \
  --header 'Authorization: <authorization>' \
  --header 'Content-Type: application/json' \
  --header 'x-client-key: <x-client-key>' \
  --data '
{
  "token": "<string>"
}
'

import requests

url = "https://api.example.com/v1/auth/oauth/authorize"

payload = { "token": "<string>" }
headers = {
    "x-client-key": "<x-client-key>",
    "Authorization": "<authorization>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'x-client-key': '<x-client-key>',
    Authorization: '<authorization>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({token: '<string>'})
};

fetch('https://api.example.com/v1/auth/oauth/authorize', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/v1/auth/oauth/authorize",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'token' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: <authorization>",
    "Content-Type: application/json",
    "x-client-key: <x-client-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/v1/auth/oauth/authorize"

	payload := strings.NewReader("{\n  \"token\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("x-client-key", "<x-client-key>")
	req.Header.Add("Authorization", "<authorization>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.example.com/v1/auth/oauth/authorize")
  .header("x-client-key", "<x-client-key>")
  .header("Authorization", "<authorization>")
  .header("Content-Type", "application/json")
  .body("{\n  \"token\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.example.com/v1/auth/oauth/authorize")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["x-client-key"] = '<x-client-key>'
request["Authorization"] = '<authorization>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"token\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "url": "<string>",
  "code": "<string>",
  "state": "<string>"
}

POST

auth

oauth

authorize

Generate Authorization Code

curl --request POST \
  --url https://api.example.com/v1/auth/oauth/authorize \
  --header 'Authorization: <authorization>' \
  --header 'Content-Type: application/json' \
  --header 'x-client-key: <x-client-key>' \
  --data '
{
  "token": "<string>"
}
'

import requests

url = "https://api.example.com/v1/auth/oauth/authorize"

payload = { "token": "<string>" }
headers = {
    "x-client-key": "<x-client-key>",
    "Authorization": "<authorization>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'x-client-key': '<x-client-key>',
    Authorization: '<authorization>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({token: '<string>'})
};

fetch('https://api.example.com/v1/auth/oauth/authorize', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/v1/auth/oauth/authorize",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'token' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: <authorization>",
    "Content-Type: application/json",
    "x-client-key: <x-client-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/v1/auth/oauth/authorize"

	payload := strings.NewReader("{\n  \"token\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("x-client-key", "<x-client-key>")
	req.Header.Add("Authorization", "<authorization>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.example.com/v1/auth/oauth/authorize")
  .header("x-client-key", "<x-client-key>")
  .header("Authorization", "<authorization>")
  .header("Content-Type", "application/json")
  .body("{\n  \"token\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.example.com/v1/auth/oauth/authorize")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["x-client-key"] = '<x-client-key>'
request["Authorization"] = '<authorization>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"token\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "url": "<string>",
  "code": "<string>",
  "state": "<string>"
}

Overview

Called after user authentication to generate an authorization code. This endpoint requires two different tokens:

JWT Token (in request body): Session token from Step 1
Access Token (in Authorization header): User access token from Step 2

In hosted UI mode, this endpoint is called automatically. In API-mode, your application calls this directly.

Request

Headers

string

required

Your public API client key

string

required

Bearer token from POST /v1/auth/loginFormat: Bearer ACCESS_TOKEN

Body

string

required

JWT session token from Step 1Format: JWTExample: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

Response

string

Complete redirect URL with authorization codeExample: https://yourapp.com/callback?state=random_csrf&code=auth_code_xyz

string

Authorization code (single-use, exchange in Step 4)Example: auth_code_xyz123

string

CSRF protection token from Step 1 (verify this matches)Example: random_csrf_protection_string_12345

Code Examples

curl -X POST "https://dev.api.baanx.com/v1/auth/oauth/authorize" \
  -H "x-client-key: your-client-key" \
  -H "Authorization: Bearer ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"token": "JWT_FROM_STEP_1"}'

const response = await fetch('https://dev.api.baanx.com/v1/auth/oauth/authorize', {
  method: 'POST',
  headers: {
    'x-client-key': 'your-client-key',
    'Authorization': `Bearer ${accessToken}`,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({ token: jwtToken })
});

const { code, state, url } = await response.json();
console.log('Authorization code:', code);
console.log('Verify state:', state === originalState);

Next Steps

Step 4: Token Exchange

Exchange authorization code for access and refresh tokens

Overview

Authentication

User

Card

Orders

Wallet

Delegation

Consent

Referral

Webhooks

Generate Authorization Code

Overview

Request

Headers

Body

Response

Code Examples

Next Steps

Step 4: Token Exchange

​Overview

​Request

​Headers

​Body

​Response

​Code Examples

​Next Steps

Step 4: Token Exchange

Overview

Request

Headers

Body

Response

Code Examples

Next Steps