## For a desktop application

Authentication for a desktop application is done as follows:

1.	Redirect a customer to the https://account.bog.ge/auth/realms/bog/protocol/openid-connect/auth, with the following parameters in the query string:
	`client_id` - Your application `client_id`
	`response_type` - A text `token` should be always passed in this parameter
	`scope` - A text `corp` should be always passed in this parameter
	`redirect_uri` – A redirect Uri of your application
	`kc_locale` – An interface language. `ka` should be passed for the Georgian language. Without passing this parameter an English interface will appear.

For example, if a client id of your application is `implicitclient` and a redirect Uri is https://example.com/callback, the address will have the following format (after URL encoding):  https://account.bog.ge/auth/realms/bog/protocol/openid-connect/auth?client_id=implicitclient&response_type=token&scope=corp&redirect_uri=https%3A%2F%2Fexample.com%3A44312%2Fcallback&state=e46fcdf4-a4bf-4dc6-8a42-e1b12e27826b&kc_locale=ka

2.	A customer will be redirected to the redirect_uri address, with the following parameters in the query string:

	- `access_token` - A temporary token
	- `expires_in` - An expiration time
	- `token_type` - A token type

3.	Authenticate using HTTP Basic Auth. On requesting the service, a Bearer Token is returned, which is used as an authentication parameter for calling the following methods.

## Header

- `Content-Type` — string, required

  `application/x-www-form-urlencoded.`

- `Authorization ` — string, required

  authentication using the HTTP Basic Auth. Use your application `client_id` as a user and a `client_secret` of your application as a password.

## Body

- `grant_type` — string, required

  A text `client_credentials` should be always passed in this parameter.

- `code` — string, required

  A temporary code

- `redirect_uri` — string, required

  Your application `redirect_uri`

## Response

- `access_token` — string

  A token returned by the authorization server.

- `token_type` — string

  A token type (A text value `bearer` being returned)

- `app_id` — string

  Not used.

- `expires_in` — string

  A number of seconds during which a token is active.

- `refresh_expires_in` — string

  The maximum time before a refresh token is expired and invalidated. It allows for the specification of a shorter timeout of refresh token than the session timeout.

- `not-before-policy` — string

  If an access token or refresh token is compromised, access the Admin Console and push a not-before revocation policy to all applications. Pushing a not-before policy ensures that any tokens issued before that time become invalid.

- `scope` — string

  A standard OAuth 2.0 authorization mechanism. A context in which a Token is valid.