Method AuthorizationCodeGrant

api/dashboard/client.go:116–154

AuthorizationCodeGrant exchanges an authorization code + PKCE code_verifier for an access token. The redirectURI must match the one used in the authorize URL.

(
	code, codeVerifier, redirectURI string,
)

// AuthorizationCodeGrant exchanges an authorization code + PKCE code_verifier
// for an access token. The redirectURI must match the one used in the authorize URL.
func (c *Client) AuthorizationCodeGrant(
	code, codeVerifier, redirectURI string,
) (*OAuthTokenResponse, error) {
	form := url.Values{
		"grant_type":    {"authorization_code"},
		"client_id":     {c.ClientID},
		"code":          {code},
		"code_verifier": {codeVerifier},
		"redirect_uri":  {redirectURI},
	}

	req, err := http.NewRequest(
		http.MethodPost,
		c.DashboardURL+"/2/oauth/token",
		strings.NewReader(form.Encode()),
	)
	if err != nil {
		return nil, err
	}
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	req.Header.Set("Accept", "application/json")

	resp, err := c.client.Do(req)
	if err != nil {
		return nil, fmt.Errorf("token request failed: %w", err)
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusOK {
		return nil, parseOAuthError(resp, "authorization code exchange")
	}

	var tokenResp OAuthTokenResponse
	if err := json.NewDecoder(resp.Body).Decode(&tokenResp); err != nil {
		return nil, fmt.Errorf("failed to parse token response: %w", err)
	}

	return &tokenResp, nil
}

// RefreshToken uses a refresh token to obtain a new access token.
func (c *Client) RefreshToken(refreshToken string) (*OAuthTokenResponse, error) {