Skip to main content

Handle the callback

After successful user authorization, AIGW redirects to the registered agent callback.

Example:

https://agent.example.com/callback?code=<AUTHORIZATION_CODE>&state=<STATE>

1. Validate state​

Compare the returned state to the value stored for the authorization transaction. Reject mismatches.

2. Exchange the authorization code​

Use the core AIGW token endpoint returned by discovery:

POST https://core.api.aigw.eval.loginid.ai/oauth2/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&code=<AUTHORIZATION_CODE>
&redirect_uri=https://agent.example.com/callback
&client_id=<AGENT_CLIENT_ID>
&client_secret=<AGENT_CLIENT_SECRET>
&code_verifier=<ORIGINAL_CODE_VERIFIER>

The supplied playground successfully received 200 for this step after a real user completed the authorization flow.

3. Store the AIGW access token​

The resulting bearer token is what the agent presents to the MCPMCPModel Context Protocol: a standard way for AI agents to call tools and data sources exposed by a server./UCP service.

Treat it as a credential

Store the AIGW access token securely and never log it in plaintext.

If a refresh token is returned and your agent needs a longer-lived session, follow the standard refresh-token behavior advertised by discovery and your AIGW policy.

Host distinction​

AIGW deliberately uses two visible host patterns in this flow:

  • authorization is per ResourceResourceThe downstream system registered in a Project. Its kind (Token exchange or OAuth client) decides the role AIGW plays.: https://api.aigw.eval.loginid.ai/<RESOURCE_ID>/oauth2/auth;
  • token issuance is global/core: https://core.api.aigw.eval.loginid.ai/oauth2/token.
Use discovery

Do not derive one host from the other. Read both endpoints from discovery metadata.

Continue to Call MCP / UCP.