Genesys Cloud - Developer Community!

 View Only

Sign Up

  • 1.  PKCE grant

    Posted 25 days ago

    We are moving our oauth implicit grant to the new pkce grant.

    1. For our app integration, do we need to send some kind of request to Genesys to update the oauth client tied with the app listing. 
    2. Does the pkce grant automatically create a listing in the org's Authorized Applications ?
      During our testing, we do not see the pkce oauth client get added to the list of authorized applications.

    Thanks

     


    #Integrations
    #PlatformAPI
    #PlatformSDK

    ------------------------------
    Kathie Phung
    ------------------------------


  • 2.  RE: PKCE grant

    Posted 20 days ago

    Hi @Kathie Phung,

    Based on my understanding, you shouldn't need to submit a request to Genesys when migrating from an Implicit Grant OAuth client to a PKCE OAuth client.

    To better understand your scenario, could you clarify the following?

    1. Are you creating the PKCE OAuth client in your own Genesys Cloud organisation, or are you planning to create it in each of your customers' (application users') Genesys Cloud organisations?

    Regarding Authorized Applications, my understanding is that when a user successfully authenticates using the PKCE OAuth client and grants consent to the requested scopes, Genesys Cloud creates an entry under Authorized Applications for that user's account. If you're not seeing the application listed after completing the authentication flow, it would be helpful to understand how you've implemented the PKCE flow.

    If you can share a few more details about your implementation, I'll be happy to take a closer look and help if I can.

    Best regards,



    ------------------------------
    Arjun Das T P
    Engineer
    Feebak Suite of products - Genesys Cloud
    https://feebak.com/
    [EmailAddress]
    ------------------------------



  • 3.  RE: PKCE grant

    Posted 19 days ago

    Thanks Arjun,

    The PKCE OAuth client is going to be created in a org that we own. I did open a support request with Genesys. They said we would need to submit an update to the app listing configuration to reference the new PKCE Client ID rather than the previous Implicit Grant Client ID. I am not sure how this will work. How do we coordinate our app deployment with the new changes for PKCE and the update required to the app listing ?



    ------------------------------
    Kathie Syarifudin
    ------------------------------

    Original Message


  • 4.  RE: PKCE grant

    Posted 19 days ago

    Hi @Kathie Syarifudin

    In the usual flow, it is not necessary to provide the PKCE client ID to the Genesys team. However, if the existing Implicit OAuth client ID is being used in the application URL or any other part of the application configuration, it will need to be updated to the new PKCE client ID.

    If you would like to avoid similar changes in the future, I would recommend storing the PKCE client ID as an environment variable or secure configuration/secret within your integration application instead of directly referencing it in the application URL or configuration files.

    Could you please confirm whether the Implicit OAuth client ID is currently being used in the application URL or any other part of your application configuration?

    Also, could you please confirm:

    • Is this a custom integration within Genesys Cloud? (About your application)
    • Are you using the Implicit or PKCE client ID in the application URL or configuration?
    • If possible, could you share a screenshot of the integration configuration page (with any sensitive information removed)?

    This will help understand the current setup and provide better guidance.



    ------------------------------
    Arjun Das T P
    Engineer
    Feebak Suite of products - Genesys Cloud
    https://feebak.com/
    [EmailAddress]
    ------------------------------

    Original Message


  • 5.  RE: PKCE grant

    Posted 19 days ago
    Edited by Kathie Syarifudin 19 days ago

    Hi Arjun

    The integration is listed in the AppFoundry. We are not using the client id in the URL. Example https://example.com/page.html?gcHostOrigin={{gcHostOrigin}}. Application type is just standalone. Nothing set in the application category and group filtering. So, it sounds like as long as we update the PKCE on our side it should still be fine ? For example, the login authentication using PKCE (from the sdk) and the PKCE client id.



    ------------------------------
    Kathie Syarifudin
    ------------------------------

    Original Message


  • 6.  RE: PKCE grant

    Posted 19 days ago

    Hi @Kathie Syarifudin

    Based on the details you've shared, I don't believe there is any need to update anything in AppFoundry, to the best of my knowledge.

    To be absolutely certain, I'd recommend sharing the details with Genesys Support or the Partner Portal team, as they can provide the final confirmation.

    For reference, we're also using the same PKCE client across our application and haven't needed to make any AppFoundry updates or communicate any changes. We store the PKCE client ID as an environment variable within our application rather than exposing it in the application URL or configuration. If you need to avoid similar concerns in the future, this is generally considered a good practice.

    I hope this helps clarify your question. If you hear back from the Genesys team, it would be great if you could share their response here as well, as it may help others who come across the same scenario in the future.



    ------------------------------
    Arjun Das T P
    Engineer
    Feebak Suite of products - Genesys Cloud
    https://feebak.com/
    [EmailAddress]
    ------------------------------

    Original Message


Related Content