# Widget using pkce

**URL:** <https://devforum.okta.com/t/widget-using-pkce/15194>\
**Category:** Questions\
**Created:** [July 20, 2021, 2:24pm UTC](https://devforum.okta.com/t/widget-using-pkce/15194 "2021-07-20T14:24:44Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![gvolop](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/gvolop/32/3144_2.png) [@gvolop](https://devforum.okta.com/u/gvolop)\
**Post date:** [July 20, 2021, 2:24pm UTC](https://devforum.okta.com/t/widget-using-pkce/15194/1 "2021-07-20T14:24:44Z")

</div>

i’m using widget with `pkce: false`, and `responseType: ['token', 'id_token']`, (OIDC web application)

the token& tokenId should pass as query param to my redirect URI , but… there is no query params at all.

when i use `responseType: ['code']` i get the code in the params.

```auto
constractor: 

this.widget = new OktaSignIn({
      el: '#okta-signin-container',
      baseUrl: 'https://XXXX.okta.com',
      clientId: 'CCCCCC',
      redirectUri: 'http://localhost:......',
      authParams: {
        issuer: 'https://XXXX.okta.com/oauth2/default',
        pkce: false,
        responseType: ['token', 'id_token']
      }
    });

ngOnInit() {
    this.widget.showSignInAndRedirect();
  }

```

what could it be?

---

<div class="post-metadata">

**Author:** ![okra-okta](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/okra-okta/32/2838_2.png) [@okra-okta](https://devforum.okta.com/u/okra-okta)\
**Post date:** [July 20, 2021, 4:22pm UTC](https://devforum.okta.com/t/widget-using-pkce/15194/2 "2021-07-20T16:22:39Z")

</div>

When you set PKCE to false and responseType is `['token', 'id_token']`, then you are using the implicit flow and the tokens are returned in a fragment.

> If `id_token` or `token` is specified as the response type, then `query` isn’t allowed as a response mode. Defaults to `fragment` in implicit and hybrid flows.

> **[OpenID Connect & OAuth 2.0 API | Okta Developer](https://developer.okta.com/docs/reference/api/oidc/#request-parameters)**
>
> Find information about the OAuth 2.0 and OpenID Connect endpoints that Okta exposes on its authorization servers.

---

<div class="post-metadata">

**Author:** ![gvolop](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/gvolop/32/3144_2.png) [@gvolop](https://devforum.okta.com/u/gvolop)\
**Post date:** [July 20, 2021, 9:25pm UTC](https://devforum.okta.com/t/widget-using-pkce/15194/3 "2021-07-20T21:25:47Z")

</div>

> [@okra-okta](#):
>
> fragment

if the data came in the fragment, so is available in angular(frontend) only?

i’m trying to use the widget and give my api route(server) as the redirect url,  
in my api , i need to verify the token and pull the user info from the token to grant access to my existing app.

is there any other way to do it?  
how can i verify & get user info from server using the “code” that came from okta login ?

---

<div class="post-metadata">

**Author:** ![okra-okta](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/okra-okta/32/2838_2.png) [@okra-okta](https://devforum.okta.com/u/okra-okta)\
**Post date:** [July 20, 2021, 10:27pm UTC](https://devforum.okta.com/t/widget-using-pkce/15194/4 "2021-07-20T22:27:50Z")

</div>

If you’re using showSignInAndRedirect then I think you need to parse the authorization code from the url and exchange it for tokens via the /token request. You can also check out the Okta Auth JS library:

> **[GitHub - okta/okta-auth-js: The official js wrapper around Okta's auth API](https://github.com/okta/okta-auth-js#tokenparsefromurloptions)**
>
> The official js wrapper around Okta's auth API. Contribute to okta/okta-auth-js development by creating an account on GitHub.

You can also check out the Okta Angular sample app as well. This one uses the widget:

> **[samples-js-angular/custom-login at master · okta/samples-js-angular](https://github.com/okta/samples-js-angular/tree/master/custom-login)**
>
> master/custom-login

---

<div class="post-metadata">

**Author:** ![gvolop](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/gvolop/32/3144_2.png) [@gvolop](https://devforum.okta.com/u/gvolop)\
**Post date:** [July 21, 2021, 6:43am UTC](https://devforum.okta.com/t/widget-using-pkce/15194/5 "2021-07-21T06:43:45Z")

</div>

> [@gvolop](#):
>
> and give my api route(server) as the redirect url,

the redirectUrl sent to my server (Elixir) so i can’t use `fragment`,  
when i try to use ‘code’, the code passed correctly to server route.

but how can i get the token from server code? (in Elixir server) (should is it possible?!)

the links you sent and also my research are all about angular or JS .  
where can i find simple rest api docs for Okta auth api ?

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [February 10, 2024, 12:46am UTC](https://devforum.okta.com/t/widget-using-pkce/15194/6 "2024-02-10T00:46:29Z")

</div>