concierge.v1.AuthService

Redeem a one-time authorization code for a RELYING PARTY's own token pair — the back half of the code flow a first-party client on another origin (the Service-Arb panel) runs against `GET /auth/authorize` (publicly `evinvest.ltd/api/auth/authorize`). Called server-to-server by the client's backend, authenticated by its client secret. The code is single-use, lives 60s, and is bound to the client, the exact redirect_uri and the PKCE (S256) challenge sent to authorize; presenting a code twice is refused AND revokes every token issued off it.

Changed on

The access token is typ=access with aud=<the client's audience> (e.g. sa) and a TTL of at most 15 minutes. It opens exactly one RPC in this plane — UserDirectory.GetMe, which answers it with a trimmed profile (no identity-document fields, no KYC level) — and is refused (UNAUTHENTICATED) everywhere else, here and on the money plane. Signing out of evinvest.ltd (Logout, RevokeSession, revoke-all) revokes the client sessions that sign-in authorized. The refresh token is opaque and bound to the client.

post/concierge.v1.AuthService/ExchangeCode

Request

  • The document declares no server URL.
  • Auth: none required

Headers

Connect-Protocol-Version1 required

Define the version of the Connect protocol

Connect-Timeout-Msnumber

Define the timeout, in ms

Request body

client_idstring
client_secretstring
codestring

The code query parameter the browser brought back to the redirect_uri.

redirect_uristring

The redirect_uri sent to authorize, byte for byte.

code_verifierstring

The PKCE verifier whose S256 challenge was sent to authorize.

Response

Success

access_tokenstring
refresh_tokenstring
user_idstring

The concierge user id — the access token's sub.

Changes