IO Wallet SDK
    Preparing search index...

    Function verifyAccessTokenRequest

    • Verifies an authorization code token request by validating PKCE, DPoP, and client attestation.

      This function performs comprehensive validation of an OAuth 2.0 authorization code token request according to Italian IT-Wallet specifications, including:

      • PKCE code verifier validation against the stored code challenge
      • DPoP proof JWT verification and JWK thumbprint extraction
      • Client attestation JWT and attestation PoP JWT verification
      • Authorization code validity and expiration checks

      Parameters

      Returns Promise<VerifyAccessTokenRequestResult>

      A promise that resolves with verified client attestation and DPoP information

      If the authorization code is invalid or expired

      If PKCE verification fails

      If DPoP verification fails

      If client attestation verification fails

      const result = await verifyAccessTokenRequest({
        accessTokenRequest: parsedRequest,
        authorizationServerMetadata: metadata,
        callbacks: { hash, verifyJwt },
        clientAttestation: { jwt: "...", popJwt: "..." },
        codeExpiresAt: new Date(Date.now() + 600000),
        dpop: {
          allowedSigningAlgs: ["ES256"],
          expectedNonce: "server-issued-nonce",
          jwt: dpopJwt,
        },
        expectedCode: "auth_code_123",
        grant: parsedGrant,
        pkce: { codeChallenge, codeChallengeMethod: "S256", codeVerifier },
        request: httpRequest,
      });

    Settings

    Member Visibility