Bokio initiated OAuth Authorization Code Grant

When the activation of an integration is started from within Bokio on a company (tenant) you can improve the user experience by using additional query parameters that we will send when activation is started and later use in the /authorize request to pre-select the company.

Bokio adds two extensions parameters to the authorize endpoint, bokio_tenantid and bokio_tenanttype.

A company user can add the integration through the integration marketplace (not yet introduced) and when they do so the request will contain two query parameters:

  • bokio_tenanttype which will always be company
  • bokio_tenantid which will be the id of the company that wants to activate.

This link could be something like: https://theintegration.com/activation?bokio_tenanttype=company&bokio_tenantid=1be29990-f977-4a62-bb03-f0e126e685d0.

When it's time to run the OAuth authorization flow, redirect the user (with company access) to using the example request below. Note the use of bokio_tenantid and bokio_tenanttype.

GET https://api.bokio.se/authorize?client_id=ed56c798-0ac8-4700-abd9-3dac99f7eca1&redirect_uri=https%3A%2F%2Fhost%2Fcallback&scope=accounting%20invoices&state=somerandomvalue&response_type=codebokio_tenanttype=company&bokio_tenantid=1be29990-f977-4a62-bb03-f0e126e685d0 HTTP 1.1

Below is an example of what the consent page will look like. Since the extension parameters are provided thereโ€™s no need to select company.

From here, everything works the same way as without the extension parameters.