Complete OIDC Login
Completes the OIDC login process by exchanging the authorization code obtained from the identity provider. Returns the user’s authentication token; when the verified user has no active first-factor credential yet, the response also includes a credential challenge so the client can register one before performing any user-action-signed operation.
Authentication
No authentication required.Required Permissions
No authentication required.Body
Response
Success
Authentication token issued to the user.
Token expiration time in epoch milliseconds.
Decoded identity for the issued token. Populated for flows whose token is not a Dfns-minted JWT (e.g. OIDC passthrough) so clients can skip JWT decoding; absent on flows where the token's claims carry the same fields.
Credential challenge offering all supported first-factor credential kinds. Included when the user has no active first-factor credential; absent once one is registered.