> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bvndle.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Authorization Code (V2)

> Call this endpoint to create an authorization code using PKCE

###

Note

:

Step 1 of 2: generate a cryptographically random codeVerifier and compute codeChallenge = BASE64URL(SHA256(codeVerifier)) without padding. Keep the verifier on the client for the token exchange; do not send it to this endpoint.

####

###

Query Parameter

name
type
Description

###

Request Body

name
type
Description

###

Generate a verifier of 43–128 characters using only `A-Z`, `a-z`, `0-9`, `-`, `.`, `_` and `~`. For example, in Node.js:

```javascript theme={null}
const crypto = require("crypto");
const codeVerifier = crypto.randomBytes(32).toString("base64url");
const codeChallenge = crypto.createHash("sha256").update(codeVerifier).digest("base64url");
const state = crypto.randomBytes(16).toString("hex");
```

The fixed challenge in the cURL example corresponds to the verifier shown on the [Get SSO Access Token (V2)](https://docs.bvndle.com/bvndle-sso/get-sso-access-token-v2.md) page. Generate a fresh pair for each login.

###

```bash cURL theme={null}
curl --request POST \
'https://test-api.bvndle.com/api/v2/ufel/users/authorization/authorization-code?scope=profile&deviceType=mobile' \
--header 'Content-Type: application/json' \
--data-raw '{
  "clientId": "<your-client-id>",
  "tag": "<user-tag>",
  "password": "<user-password>",
  "codeChallenge": "Zb25qaaHzAyaS5_YK9-tj0YcmNnggu0bjvutHn2-Js0",
  "codeChallengeMethod": "S256",
  "state": "7f3c9a1e5b2d48c6a0e1f4b7d9c23e68"
}'
```

###

```json Success theme={null}
{
  "status": "success",
  "message": "RedirectUrl and authorization code fetched successfully",
  "data": {
    "redirectUrl": "https://google.com?authorization-code=GDTC1ZHSNSEO95QDXMCT&state=7f3c9a1e5b2d48c6a0e1f4b7d9c23e68"
  }
}
```

```json Error 400 theme={null}
{
  "status": "failed",
  "message": "invalid data provided",
  "data": {
    "errorType": "invalid",
    "appErrorCode": "",
    "error": "Unsupported code challenge method"
  }
}
```

###

Response

:

This endpoint returns JSON, not an HTTP redirect. Read authorization-code and state from the query string of data.redirectUrl. If you sent state, URL-decode it and compare it with the saved value before exchanging the code. Stop the login if it is missing or different. Step 2 does not return state.

###

Expiry

:

The authorization code expires after 30 minutes and can be exchanged only once. Each new authorization request replaces the user's previous code, challenge and state. The SSO token is created at this step and expires after 15 minutes, so exchange the code immediately.

Continue with [Get SSO Access Token (V2)](https://docs.bvndle.com/bvndle-sso/get-sso-access-token-v2.md), sending the authorization code and original verifier.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.