Interface: AuthorizationCodeAuthConfig

Defined in: canton/authentication/types.ts:129

authorizationCode auth config (RFC 6749 §4.1 + PKCE RFC 7636).

This config describes the protocol parameters only. The environment-specific orchestration (local callback server, browser opening, flow timeout) is owned by the CLI / embedder, not the SDK.

Extends

• AuthConfigBase

Properties

audience?

optional audience?: string

Defined in: canton/authentication/types.ts:95

OAuth2 "audience" request parameter (Auth0-specific extension).

Identifies the API the issued access token should target (its JWT aud claim). Only honored by Auth0 (or servers emulating Auth0); Okta/Keycloak ignore it. Applicable to clientCredentials and authorizationCode only.

Inherited from

AuthConfigBase.audience

---

authUrl

authUrl: string

Defined in: canton/authentication/types.ts:132

OIDC authorization server base URL (e.g. https://auth.example.com).

---

callbackUrl?

optional callbackUrl?: string

Defined in: canton/authentication/types.ts:145

Redirect URI the authorization server redirects back to.

Required by the protocol helpers (buildAuthorizationRequest, exchangeAuthorizationCode); the embedder supplies the value that matches its callback handling (e.g. http://localhost:8400/callback for the CLI's local server).

---

clientId

clientId: string

Defined in: canton/authentication/types.ts:134

OAuth2 client identifier.

---

scopes?

optional scopes?: string[]

Defined in: canton/authentication/types.ts:136

OAuth2 scopes. Defaults to ["openid", "daml_ledger_api"].

---

type

type: "authorizationCode"

Defined in: canton/authentication/types.ts:130

Auth scheme selector. Defaults to "static" when omitted (backward compatible).

Overrides

AuthConfigBase.type