oauth_authorization_codes

{“what”:“Unique opaque identifier for this authorization code record.”,“why”:“Without it, there is no stable way to reference a specific issuance for revocation or audit.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:55:33.425050026+00:00”}

{“what”:“Cryptographic hash of the authorization code value; the code itself is never stored.”,“why”:“Without it, a presented code cannot be matched to its issuance record, so authorization fails.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:55:33.453641895+00:00”}

{“what”:“Identifier of the OAuth client that requested the code.”,“why”:“Without it, the token endpoint cannot verify that the presenting client matches the original requester.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:55:33.471783852+00:00”}

{“what”:“Identifier of the user who granted authorization for this code.”,“why”:“Without it, the token endpoint cannot associate the issued token with the correct user account.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:55:33.503620147+00:00”}

{“what”:“Exact redirect URI used in the authorization request.”,“why”:“Without it, the token endpoint cannot validate the redirect URI in the token request, enabling open redirect attacks.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:55:33.519994704+00:00”}

{“what”:“Space-separated list of OAuth scopes granted for this code.”,“why”:“Without it, the token endpoint cannot issue a token with the correct permissions, and resource access limits break.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:55:33.541341091+00:00”}

{“what”:“Optional nonce value from the authorization request, used to bind the ID token to the session.”,“why”:“Without it, the client cannot detect replay of an ID token, breaking OpenID Connect security.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:55:33.553316232+00:00”}

{“what”:“PKCE code challenge derived from the verifier; used to prove possession of the verifier.”,“why”:“Without it, the token endpoint cannot perform PKCE verification, leaving public clients vulnerable to code interception.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:55:33.566781638+00:00”}

{“what”:“Method used to derive the code challenge, either ‘S256’ or ‘plain’.”,“why”:“Without it, the token endpoint cannot compute the challenge from the verifier, so PKCE verification fails.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:55:33.581532226+00:00”}

{“what”:“Timestamp when the authorization code was issued.”,“why”:“Without it, the token endpoint cannot enforce the code’s lifetime or determine if it has expired.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:55:33.601198954+00:00”}

{“what”:“Timestamp after which the authorization code is no longer valid.”,“why”:“Without it, codes would never expire, allowing indefinite reuse and increasing theft risk.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:55:33.624337600+00:00”}

{“what”:“Flag indicating whether the code has already been redeemed; true after successful token exchange.”,“why”:“Without it, the same code could be redeemed multiple times, breaking the one-time-use requirement of OAuth2.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:55:33.652557444+00:00”}