---
category: [Administration & Integrations, Platform and Product Extensions, Platform and Product Extensions/Integration, Administration & Integrations/Custom Integrations & Apps, Platform and Product Extensions/Workday Extend]
keyword: [Extend, OAuth]
nav: wcp_docs
parent_url: /wcp_docs/
title: Authenticate Using the Authorization Code Grant Type
layout: subsection
---

### Prerequisites

<a id="prereq_N10021_N1001E_N10001"></a>
[Register your API Client](/wcp_docs/zwx1518028675482.html) on the Workday Developer Site.

### Context

<a id="context_N1002A_N1001E_N10001"></a>
For this authorization flow, the user first submits an authorization request to the authorize endpoint, which returns an authorization code. The user submits the authorization code to the token endpoint, which returns an access token and a refresh token.

### Steps

1.  <a id="step_N10035_N10032_N1001E_N10001"></a>Submit an authorization request to the authorize endpoint. Use these query parameters:

    -   response_type: `code` (for authorization code grant).
    -   client_id: Use the value received at client registration.
    -   redirect_uri (Optional): Indicates the URL to return the user to after authorization is complete. Use the value you configured on the client at registration.
    -   state: A random string generated by your app, which you’ll verify later.

    Example:

    ```
    GET https://auth.api.workday.com/v1/authorize?response_type=code&client_id=ODQ4ZDdkNzItMzhiMC00YmFmLTgyNzAtNzljNjM0MDlmNmY2&redirect_uri=https://example.com&state=xyz
    ```

    After the user signs in and approves access to Workday resources (if required), the authorize endpoint returns the authorization code.

    For this example, the redirect URI was set to https://example.com during client registration:

    ```
    HTTP/1.1 302 Found Location: https://example.com/#code=88xr1xk2snm6u6pk5yc6yqef0&state=xyz
    ```

2.  <a id="step_N100AB_N10038_N1001F_N10001"></a>Create a POST request to call the token endpoint. A complete token request includes these parameters:

    -   grant_type: `authorization_code` (indicates the grant type of this token request).
    -   client_id: Use the value received at client registration.
    -   redirect_uri (Optional): Use the value you configured on the client at registration.
    -   code: The authorization code returned from the authorize endpoint in the previous step.

3.  <a id="step_N100C7_N1003B_N1001E_N10001"></a>Get the Client ID and the Client Secret of the API Client from the Console on the Workday Developer Site. These values will enable you to provide the proper headers to call the endpoint.
4.  <a id="step_N100D8_N1003B_N1001E_N10001"></a>Encode these values into Base64 format. Use the format `[Client ID]:[Client Secret]`. Do not add a space after the colon.
5.  <a id="step_N10123_N10038_N1001F_N10001"></a>Build the Authorization header and body.
    1.  Populate the header of the request with `ID [Encoded Value]`. You must add a space after ID.

        Example:

        ```
        Authorization: ID T0RRNFpEZGtOekl0TXpoaU1DMDBZbUZtTFRneU56dE56bGpOak0wTURsbU5tWTI6YmtteGNveWg1M29kOXg3dmZ6andvbWVoN2ozejJwZ2hucHRpeHdmcHB5eGxmeG8ybDY0bmx1M3V2aTR5bGgxNXphZGZ0YXB3dnBibTk4bmFrMjZ2OGpwamQzNnhyanlu== 
        ```

    2.  Populate the body of the request with the appropriate keys and values. Use the <i>x-www-form-urlencoded</i> option to specify that the values will be encoded inside the URL itself. This option adds a new header to specify the content-type.

        Example:

        ```
        grant_type=authorization_code&code=88xr1xk2snm6u6pk5yc6yqef0&client_id=ODQ4ZDdkNzItMzhiMC00YmFmLTgyNzAtNzljNjM0MDlmNmY2&redirect_uri=https://example.com
        ```


6.  <a id="step_N10163_N10038_N1001F_N10001"></a>Use the Authorization header and body that you built to submit the request to the token endpoint. Example:

    ```
    POST https://auth.api.workday.com/v1/token 
    ```

    The token endpoint returns the access token and refresh token. Example:

    ```
    {
        "access_token": "7c3obrknwd6nnkxv0r64jdpbx",
        "refresh_token": "yxsiqvdkakj0tp9a4i2xe1fbg4blgrq1noqz2nt1cr4f8dfjpazw0jwe18a2wn656854pzb5vmcqnhpqspytg0cf5jlidyjgnfg",
        "token_type": "Bearer"
    }
    ```

7.  <a id="step_N1007F_N10032_N1001E_N10001"></a>To subsequently access Workday resources, set the Authorization header in the requests you send to the Workday REST API endpoint. Set the Authorization header to the token_type value and access_token value. Example:

    ```
    GET https://api.workday.com/common/v1/workers Authorization: Bearer 7c3obrknwd6nnkxv0r64jdpbx
    ```



### Next Steps

<a id="postreq_N100B2_N1001E_N10001"></a>
The token timeout is tied to the session timeout configured for the user by the Workday administrator. When the token expires, request a new access token with a refresh token.

### Related Information

[Request a New Access Token with a Refresh Token](/wcp_docs/cqa1553122177664.html)

[Reference: Workday Extend API Gateways and Authorization Base URLs](/wcp_docs/dlh1653340161856.html)