Skip to main content
​
type
enum<string>
required
Enum options: ACTIVITY_TYPE_OAUTH2_AUTHENTICATE
​
timestampMs
string
required
Timestamp (in milliseconds) of the request, used to verify liveness of user requests.
​
organizationId
string
required
Unique identifier for a given Organization.
​
parameters
object
required

The parameters object containing the specific intent data for this activity.

​
generateAppProofs
boolean
Enable to have your activity generate and return App Proofs, enabling verifiability.
A successful response returns the following fields:
​
activity
object
required
The activity object containing type, intent, and result
curl --request POST \
  --url https://api.turnkey.com/public/v1/submit/oauth2_authenticate \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --header "X-Stamp: <string> (see Authorizations)" \
  --data '{
    "type": "ACTIVITY_TYPE_OAUTH2_AUTHENTICATE",
    "timestampMs": "<string> (e.g. 1746736509954)",
    "organizationId": "<string> (Your Organization ID)",
    "parameters": {
        "oauth2CredentialId": "<string>",
        "authCode": "<string>",
        "redirectUri": "<string>",
        "codeVerifier": "<string>",
        "nonce": "<string>",
        "bearerTokenTargetPublicKey": "<string>"
    }
}'

import { Turnkey } from "@turnkey/sdk-server";

const turnkeyClient = new Turnkey({
  apiBaseUrl: "https://api.turnkey.com",
  apiPublicKey: process.env.API_PUBLIC_KEY!,
  apiPrivateKey: process.env.API_PRIVATE_KEY!,
  defaultOrganizationId: process.env.ORGANIZATION_ID!,
});

const response = await turnkeyClient.apiClient().oauth2Authenticate({
  oauth2CredentialId: "<string> (The OAuth 2.0 credential id whose client_id and client_secret will be used in the OAuth 2.0 flow)",
  authCode: "<string> (The auth_code provided by the OAuth 2.0 provider to the end user to be exchanged for a Bearer token in the OAuth 2.0 flow)",
  redirectUri: "<string> (The URI the user is redirected to after they have authenticated with the OAuth 2.0 provider)",
  codeVerifier: "<string> (The code verifier used by OAuth 2.0 PKCE providers)",
  nonce: "<string> (A nonce value set to sha256(publicKey), used to bind the OIDC token to a specific public key)",
  bearerTokenTargetPublicKey: "<string> (An optional P256 public key to which, if provided, the bearer token will be encrypted and returned via the `encrypted_bearer_token` claim of the OIDC Token)"
});

{
  "activity": {
    "id": "<activity-id>",
    "status": "ACTIVITY_STATUS_COMPLETED",
    "type": "ACTIVITY_TYPE_OAUTH2_AUTHENTICATE",
    "organizationId": "<organization-id>",
    "timestampMs": "<timestamp> (e.g. 1746736509954)",
    "result": {
      "activity": {
        "id": "<string>",
        "organizationId": "<string>",
        "status": "<string>",
        "type": "<string>",
        "intent": {
          "oauth2AuthenticateIntent": {
            "oauth2CredentialId": "<string>",
            "authCode": "<string>",
            "redirectUri": "<string>",
            "codeVerifier": "<string>",
            "nonce": "<string>",
            "bearerTokenTargetPublicKey": "<string>"
          }
        },
        "result": {
          "oauth2AuthenticateResult": {
            "oidcToken": "<string>"
          }
        },
        "votes": "<array>",
        "fingerprint": "<string>",
        "canApprove": "<boolean>",
        "canReject": "<boolean>",
        "createdAt": "<string>",
        "updatedAt": "<string>"
      }
    }
  }
}