# API Gateway Auth Code Exchange **URL:** \ **Category:** Questions\ **Created:** [November 15, 2018, 8:29am UTC](https://devforum.okta.com/t/api-gateway-auth-code-exchange/3370 "2018-11-15T08:29:04Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Govner](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/govner/32/1099_2.png) [@Govner](https://devforum.okta.com/u/Govner)\ **Post date:** [November 15, 2018, 8:29am UTC](https://devforum.okta.com/t/api-gateway-auth-code-exchange/3370/1 "2018-11-15T08:29:04Z")
If we pass to an API gateway an auth code can it then invoke the /token endpoint with its own OAuth credentials and exchange the authorization\_code for an access token? Additionally, can the token endpoint support an additional parameter, such as id\_token parameter in the /token endpoint for the Client Credentials Flow or can we exchange an existing access token (for some API) for an authorization\_code (to another API) ---
**Author:** ![bdemers](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/bdemers/32/23_2.png) [@bdemers](https://devforum.okta.com/u/bdemers)\ **Post date:** [November 16, 2018, 6:56pm UTC](https://devforum.okta.com/t/api-gateway-auth-code-exchange/3370/2 "2018-11-16T18:56:27Z")
Hey @Govner! I’m not sure I understand your question completely. It sounds like you have an API Gateway and you have questions around passing tokens to other services (behind the gateway)? ---
**Author:** ![thabach](https://avatars.discourse-cdn.com/v4/letter/t/ecc23a/32.png) [@thabach](https://devforum.okta.com/u/thabach)\ **Post date:** [November 16, 2018, 7:32pm UTC](https://devforum.okta.com/t/api-gateway-auth-code-exchange/3370/3 "2018-11-16T19:32:03Z")
Heya @bdemers yes, true - that is what @Govner (and myself 🙂 ) have as a scenario and a couple of questions on those accounts. The first question refers to a scenario where an API Gateway receives an authorization code and the gateway-embedded OAuth client is _not_ the one that was referenced in the original “redirecting” of the user in the frontend-flow of the authorization code grant type flow. Cheers. ---
**Author:** ![bdemers](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/bdemers/32/23_2.png) [@bdemers](https://devforum.okta.com/u/bdemers)\ **Post date:** [November 16, 2018, 9:18pm UTC](https://devforum.okta.com/t/api-gateway-auth-code-exchange/3370/4 "2018-11-16T21:18:48Z")
Are the services behind the gateway also perform OAuth 2 Authorization code flow redirects? ---
**Author:** ![thabach](https://avatars.discourse-cdn.com/v4/letter/t/ecc23a/32.png) [@thabach](https://devforum.okta.com/u/thabach)\ **Post date:** [November 16, 2018, 9:40pm UTC](https://devforum.okta.com/t/api-gateway-auth-code-exchange/3370/5 "2018-11-16T21:40:11Z")
Those services behind the gateway are the ones the authorization\_code “targets” (of course only after being exchanged for an access token but in our scenario, by the gateway with its OAuth2 client credentials, and not by the OAuth2 client “part” of the frontend-flow). To answer your question, those services are not performing any redirects but are the targets receiving the access token stemming from the backend-flow of the OAuth2 authorization code flow, which itself is exercised by the gateway OAuth client. ---
**Author:** ![bdemers](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/bdemers/32/23_2.png) [@bdemers](https://devforum.okta.com/u/bdemers)\ **Post date:** [November 16, 2018, 10:00pm UTC](https://devforum.okta.com/t/api-gateway-auth-code-exchange/3370/6 "2018-11-16T22:00:01Z")
Sorry guys, I’m still not sure I understand the question. Do you have any form of auth between the gateway and the service (or is that what you are asking?) Also, what stack are you on? We might be able to suggest an existing library. ---
**Author:** ![thabach](https://avatars.discourse-cdn.com/v4/letter/t/ecc23a/32.png) [@thabach](https://devforum.okta.com/u/thabach)\ **Post date:** [November 16, 2018, 10:26pm UTC](https://devforum.okta.com/t/api-gateway-auth-code-exchange/3370/7 "2018-11-16T22:26:45Z")
no worries 🙂 let me try being more concrete: Let’s say we have a BFF (backend for frontend) that a user connects to with his browser and is sent into an OAuth2 authorization code flow redirect dance to Okta. This BFF has some client id that is passed as part of the redirect to Okta. The user happily authenticates and gives some consent for access rights for a downstream service which is living behind an API Gateway. The BFF will have to issue its call through this gateway in reaching the downstream service. Okta issues an authorization code, which the BFF will receive. All fine, if the service was not living behind a gateway, the BFF would now on a backend channel with the very same OAuth2 client id go to Okta and exchange the authorization\_code for an access-token. **But** in our case it will not do that, but rather pass the authorization\_code on to the gateway, which will only then (protecting its security domain), go with **_its own_** OAuth2 credentials go to Okta for the exchange. Will that work ? or does the OAuth client id have to match with the original id used in the frontend flow that produced the authentication\_code ? hope its clearer now 🙂 ---
**Author:** ![Govner](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/govner/32/1099_2.png) [@Govner](https://devforum.okta.com/u/Govner)\ **Post date:** [November 21, 2018, 11:12am UTC](https://devforum.okta.com/t/api-gateway-auth-code-exchange/3370/8 "2018-11-21T11:12:03Z")
I assume the token endpoint can have the code parameter specified by the API gateway assuming the API gateway also knows the client ID and secret of the original requesting application: [https://developer.okta.com/docs/api/resources/oidc#request-parameters-1](https://developer.okta.com/docs/api/resources/oidc#request-parameters-1) ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [January 13, 2024, 12:01am UTC](https://devforum.okta.com/t/api-gateway-auth-code-exchange/3370/9 "2024-01-13T00:01:09Z")
Closed on January 13, 2024, 12:01am UTC