Connect to the SpeedyCraft API from a mobile app / Authorization Code flow

Please note that this article only refers to the use of Authorization Code flow. Please go to the default way of connecting to REST API if this is not relevant for you: Connect to SpeedyCraft REST API using Devinco Connect.

Mobile apps must use the authorization code flow to authorize the user in Devinco Connect. See https://auth0.com/docs/flows/authorization-code-flow for more info on the flow itself. The steps needed to authorize are:

1. The user initiates the authorization/login (via a link or a button in the app)

2. The app redirects the user to the Devinco Connect login page (opening a web page by using some kind of web view or api)

3. The user logs in. After login, Connect sends a code in return via the redirect_uri provided by the consumer. This code is good for one use only.

4. Send this code, together with Client Id, Client Secret and the redirect uri for the app to Devinco Connect. The Client Id and Client Secret are provided by Devinco. Devinco Connect returns id-, access- and refresh tokens. Use the access token to call the SpeedyCraft API. The id token is used to log out from a Devinco Connect session.

In some more detail…

Step 1 - Send the user to the login window (point 2 above):

For the stage environment: 
https://connect-stage.devinco.com/connect/authorize?client_id=speedycraft.client&redirect_uri=<your-redirect-uri>&response_type=code id_token&scope=openid speedycraft:api offline_access&state=<some-random-value>&nonce=<some-random-value>

For the production environment:
https://connect.devinco.com/connect/authorize?client_id=speedycraft.client&redirect_uri=<your-redirect-uri>&response_type=code id_token&scope=openid speedycraft:api offline_access&state=<some-random-value>&nonce=<some-random-value>

Step 2 - After login, get access/refresh tokens (point 4 above), send a POST request to:

https://connect.devinco.com/connect/token

with the following body/payload:

grant_type: authorization_code
client_id: speedycraft.client
client_secret: <your-client-secret>
code: <the-code-returned-in-step-1>
redirect_uri: <your-redirect-uri>

Step 3 - Refresh the access token (without user interaction)

https://connect.devinco.com/connect/token

with the following body/payload:

grant_type: refresh_token
client_id: speedycraft.client
client_secret: <your-client-secret>
refresh_token: <your-refresh-token>