Testing OAuth 2.0 Authorization Flow with curl

1. Complete the OAuth 2.0 Authorization Flow

Before using the curl command to obtain tokens, you first need to get an authorization code from your OAuth provider. This is done by directing the user to the provider’s authorization URL, where they will log in and authorize the application.

Here’s an example of how you might retrieve the authorization code by redirecting the user to the OAuth provider’s authorization endpoint:

https://gitlab.com/oauth/authorize?response_type=code&client_id=YOUR_CLIENT_ID&redirect_uri=YOUR_REDIRECT_URI&scope=profile%20email%20openid%20offline_access

* you may need additional parameter &prompt=login OR &prompt=consent for Microsoft Entra (Azure)

Once the user authorizes the application, the OAuth provider will redirect to your redirect_uri with the code in the query parameters:

https://your-redirect-uri?code=AUTHORIZATION_CODE

2. Exchange Authorization Code for Tokens

You can use the curl command to exchange this authorization code for an access_token and refresh_token. Here's an example of a request to do that:

curl -X POST https://gitlab.com/oauth/token \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET" \
  -d "grant_type=authorization_code" \
  -d "code=AUTHORIZATION_CODE" \
  -d "redirect_uri=YOUR_REDIRECT_URI"

3. Refresh the Token (if needed)

When your access_token expires, you can use the refresh_token to request a new access_token without re-authenticating the user. Here’s an example of how you can use the refresh_token to get a new access_token:

curl -X POST https://gitlab.com/oauth/token \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET" \
  -d "grant_type=refresh_token" \
  -d "refresh_token=YOUR_REFRESH_TOKEN"