Authorization Code

🚧 Sandbox vs. Production

Tokens have some particularities based on the environment in which they were issued. This allows the environments to operate in parallel and without interaction with each other, thereby increasing security and ensuring that any issues do not affect both environments at the same time.

It is extremely important to read the articles about the Production and Sandbox environments.

Below is a brief summary of the particularities mentioned above:

Sandbox

Tokens generated in the sandbox environment allow consent to be given only to the company dedicated to the environment's operation;

The companyId and accountId used in requests, along with the other token claims, will derive from the CNPJ 30306294000145;

Any user with developer permission or higher can log in during the flow to issue this token.

Production

Tokens generated in the production environment allow consent to be given to the company where the application was created (First-party) or to any company the logged-in user is linked to (Third-party);

The companyId and accountId used in requests will be those of the company for which consent was given;

Only the login of an operator user or higher will result in a valid token. Using a developer user will cause an error when making the API calls.

This is the standard Authorization Code flow required to obtain the Access Token and Refresh Token. In this section we break down the entire flow to give you, the developer, the smoothest experience possible.

First, the application sends the registered Client Id and Redirect URI to the authentication server, together with the scopes authorized by the end user, as in this example:
```
GET /oauth2/authorize?client_id={client_id}&response_type=code&redirect_uri={redirect_uri}&scope={scope}&prompt=login HTTP/1.1
Host: id.btgpactual.com
```
In response, if the process is authorized, the authentication server returns the Authorization Code as shown below:
```
HTTP/1.1 302 Found
Location: {redirect_uri}?code={authorization_code}&iss=https%3A%2F%2Fid.btgpactual.com
```

After receiving the Authorization Code, you must make the Access Token request as in the example below:

POST /oauth2/token HTTP/1.1
Host: id.btgpactual.com
Content-type: application/x-www-form-urlencoded
Authorization: Basic <client_id:client_secret> // Base 64 encoded

 code={authorization_code}&redirect_uri={redirect_uri}&grant_type=authorization_code

At this stage, the BTG Id authentication and authorization servers verify the validity of the information sent and, if there are no errors or invalid codes, the server returns the Access Token and the Refresh Token along with other relevant information such as the authorization scope, the token id, the token type, and the token duration:

HTTP/1.1 200 OK
Content-Type: application/json

{
 "access_token":"eyJhbGciOiJS",
 "refresh_token":"WV6G4HKBr",
 "scope":"apps email openid profile webhooks",
 "id_token":"eyJhbGciOiJIUzI1NiJ9.eyJ"
 "token_type":"Bearer",
 "expires_in":86400
}

From here, with your Access Token in hand, you can consume the APIs as permitted by the end user!

Sandbox​

Production​

Sandbox

Production