Azure ADB2C | PKCE Flow

Question

Hi

I just wanted to know

I am working on a pkce flow of getting a token from adb2c custom policy user sign in flow

So i hit /authorize and get the auth code after login
use the auth code with code challenge to hit /token and get the access token

just wanted to know how many times can I hit the /token api with the same auth code ?
is there a limit ?
what is the limit ?

Answer 1

Hi @Abhay Chandramouli ,

Thanks for reaching out.

Authorization code are very short lived. Typically, they expire after 10 minutes. You can use them to redeem the token from token endpoint only once.

Once you get the token, next time you will get the below error when trying to redeem the token from same authorization code:

"AADSTS54005: OAuth2 Authorization code was already redeemed, please retry with a new valid code or use an existing refresh token"

Hope this will help.

Thanks,
Shweta

------------------------------------

Please remember to "Accept Answer" if answer helped you.