Genesys Cloud - Developer Community!

 View Only

Sign Up

Back to discussions
Expand all | Collapse all

Alternatives to popup-based OAuth PKCE flow in Interaction Widget after Implicit Grant deprecation

  • 1.  Alternatives to popup-based OAuth PKCE flow in Interaction Widget after Implicit Grant deprecation

    Posted 01-16-2026 15:17
    Edited by Danna Espinosa Arenas 01-16-2026 16:49

    Hello community,

    Due to the deprecation of Implicit Grant, we are migrating our standalone / Interaction Widget application to a more secure OAuth PKCE flow.

    With PKCE, since there is no refresh token, once the access token expires the user must perform a re-login. We initially attempted to handle this using hidden iframes, but this approach caused issues within the Interaction Widget, so we moved to a popup-based login.
    We also extended the access token lifetime to 1 hour to reduce the frequency of re-authentication.

    The main challenges are:

    • The popup is intrusive and negatively impacts the user experience.

    • Hidden iframes are not a viable option within the widget.

    Question:
    Has anyone implemented an OAuth PKCE flow for the Interaction Widget that avoids using popups and iframes, while still maintaining a secure and smooth user experience?
    Any recommended patterns, architectural approaches, or references to official documentation would be greatly appreciated.

    Thanks in advance.


    #Integrations
    #PlatformAPI
    #PlatformSDK

    ------------------------------
    Danna Espinosa Arenas
    ------------------------------



Related Content