Last update:
Use case for the application - 1099 eStatements
Aug 21, 2026
- User clicks on the redirect URL of the application say https://dummy.optum.com. We are using a test URL for privacy.
- The client application makes a POST call to the One healthcare ID authorization URL. After successful validation of client id, scopes and redirect URL and redirects to One Healthcare ID login page on successful verification.
- After successful login, the authorization server redirects back to the redirect URL with an authorization code.
For more details, please refer https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest. - Client application makes a call to token server with client id, secret and authorization code to receive the ID token, access token and refresh token.
- If Client authentication has failed, 401 unauthorized status code will be received in response.
- If authorization code is invalid or expired – a 400 bad request status code will be received in response.
- Access Token A token generated by OpenID Connect Provider and returned to a client application which the client application can use to access UserInfo endpoint or other Resource Servers (aka API) on behalf of end user. It is typically valid for 30 minutes for One Healthcare ID applications.
- Refresh Token Additional token generated by authorization server which can be used by client application to refresh and obtain new access token when previous token expires. Typically access token has short lifeline as they spend more time on user-agent and can be stolen, a refresh token should never be revealed to user-agent and will have a longer lifespan than access token and is used by client application server-side components to obtain a new access token by interacting with authorization server. This limits the risk of a stolen access token in extreme cases. It is typically 8 hours validity.
- ID Token A Json web token (JWT) which is returned by OpenID Connect which contains the identity claims about the end-user. This is typically valid for 5 minutes.
- On completion of all successful validation of ID Token, client application can extract claims/identity attributes/Big 5 etc. from ID Token and start its own loosely coupled application session and render application specific content to user.Note: For more details refer https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint.
Previous:
Sample use case
Share additional feedback to help us improve.
0/255
|
Powered by Aikyam @2025 All rights reserved
+1 866 451 2735
+1 866 451 2735
+1 855 819 5909