Authorization
For Authorization, CandidateZip will ask the user to log in (if necessary) and to authorize the application with the Client ID and Client Secret.
Users can choose to deny the authorization request as well. Afterward, CandidateZip will redirect the resource owner back to the redirect URL provided in App Registration. The redirect URL will include the authorization code within the code query parameter and the state value given in the previous request.
For this, your client application directs a resource owner to the OAuth 2.0 authorization
endpoint
i.e.
https://app.candidatezip.com/authorize?client_id=<CLIENT_ID>&redirect_uri=<REDIRECT_URL>&response_type=code&state=<STATE>
This includes the following query parameters:
- response_type: Must be set to code.
- client_id: The same unique identifier of the client you received from registration.
- redirect_uri: The same URL you registered as Callback URL during the client registration.
- state: (optional) A string used to maintain state between the request and callback. The parameter is used to protect against Cross-Site Request Forgery (CSRF).