Skip to main content
Version: Latest (4.0.6)

Initiate CIBA Authentication

POST 
/authz-srv/ciba

Client-Initiated Backchannel Authentication (CIBA)

This API initiates the CIBA flow. The client authenticates, sends user identification and request parameters; the server creates an authentication request, starts verification on the user's authenticator device, and returns an auth_req_id. Use that id with POST /token-srv/token and grant_type=urn:openid:params:grant-type:ciba to obtain tokens (poll), or wait for a ping notification and then call the token endpoint once.

Prerequisites

  • The tenant CIBA feature must be enabled. Otherwise the API returns 403 with error_code AUTH10074 (error is invalid_request).
  • Configure the application for CIBA in Admin UI (grant type urn:openid:params:grant-type:ciba and optional ciba_config). The initiation endpoint does not validate that grant type; POST /token-srv/token with grant_type=urn:openid:params:grant-type:ciba does.
  • Use a confidential OAuth client. Public clients (token_endpoint_auth_method none) fail client authentication (401, AUTH10060).
  • The user resolved from login_hint must have a completed MFA-relevant verification method (priority: Face → Touch ID → Pattern).

Client authentication Same family of OAuth client authentication as the token endpoint, driven by the app's token_endpoint_auth_method. For client_secret_post, send credentials in the body (no entry under security applies):

  • Basic Authentication (client_secret_basic): Authorization: Basic <base64(client_id:client_secret)>
  • client_secret_post: send client_id and client_secret in the request body
  • private_key_jwt / client_secret_jwt: send client_assertion and client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer in the body (do not put the assertion in the Authorization header)
  • mTLS (tls_client_auth / self_signed_tls_client_auth) when the tenant mTLS feature is enabled

Content types: application/json or application/x-www-form-urlencoded (both accepted).

Scopes: Requested scopes are intersected with the app's allowed scopes (disallowed values are dropped silently). After filtering, openid must remain or the request fails with AUTH10077.

Poll vs ping: Response fields are the same. For apps with backchannel delivery mode ping, include client_notification_token and ensure backchannel_client_notification_endpoint is set on the app. Push delivery mode is not supported on this endpoint.

Optional signed request: When request (JWT) is present, its claims replace the body parameters after verification (AUTH10096 on failure).

See CIBA documentation for the full flow.

Request​

Responses​

OK - CIBA authentication request created successfully.