Exchange code for token

This guide is about the server half of sign-in: you have the code from onSuccess, and you need to get a token and identify the user.

Exchange the code

POSThttps://id.fidmos.com/oauth/token

Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code&
code=RECEIVED_CODE&
redirect_uri=https://partner.example/callback&
client_id=YOUR_CLIENT_ID&
client_secret=YOUR_CLIENT_SECRET&
code_verifier=CODE_VERIFIER_FROM_INIT_STEP

The response contains access_token (1-hour lifetime), refresh_token (30 days) and id_token.

Read the profile

There are two ways to learn who the user is; both yield the same sub field.

• From id_token — it is a JWT; verify the signature with the keys from JWKS and take the sub claim.
• Through UserInfo — call GET /oauth/userinfo with Authorization: Bearer <access_token>.

GEThttps://id.fidmos.com/oauth/userinfo

Authorization: Bearer ACCESS_TOKEN

Do not hardcode endpoint addresses — take them from GET /.well-known/openid-configuration (discovery).

Note

sub is pairwise: it is stable for your client, but at another partner the same person gets a different sub. It is the user’s identifier specifically within your integration.

Refresh the token

POSThttps://id.fidmos.com/oauth/token

Content-Type: application/x-www-form-urlencoded

grant_type=refresh_token&
refresh_token=REFRESH_TOKEN&
client_id=YOUR_CLIENT_ID&
client_secret=YOUR_CLIENT_SECRET

Full request and response schemas are in the API reference.