Integration

The detailed implementation page for BBaton Login. Authorize request → redirect handling → token issuance → user info retrieval: implement four real API calls, in order.

01 Request the authorization code

Open the BBaton login screen and request an authorization code after user login. If a session exists on the BBaton server, the code is returned immediately; otherwise the ID/password screen is shown first.

// Navigate in the current window
location.href = "https://bauth.bbaton.com/oauth/authorize?client_id={CLIENT_ID}&redirect_uri={REDIRECT_URI}&response_type=code&scope=read_profile&state={STATE}";

// Or open as a popup
window.open(
  "https://bauth.bbaton.com/oauth/authorize?client_id={CLIENT_ID}&redirect_uri={REDIRECT_URI}&response_type=code&scope=read_profile",
  "bbaton", "width=400, height=500"
);

02 Receive the code at your Redirect URL

The response is redirected to your redirect_uri with the authorization code or an error in the query string. On success, the code arrives as http://redirect_uri?code={CODE}.

03 Exchange the code for a token

After receiving the code, call the token API. You can request user info only after the token is issued. BBaton account sessions last 24 hours by default and do not change after first authentication.

// Exchange the code received at the Redirect URI
const url = "https://bauth.bbaton.com/oauth/token";
const auth = "Basic " + Buffer.from(client_id + ":" + secret_key).toString("base64");

// Body: grant_type=authorization_code&redirect_uri={REDIRECT_URI}&code={CODE}
// Header: Authorization: auth

04 Request user info with the token

With the token issued, request user info at /v2/user/me using an Authorization: {token_type} {access_token} header.

// Use token_type and access_token from step 3
const url = "https://bapi.bbaton.com/v2/user/me";
const auth = response.data.token_type + " " + response.data.access_token;

// Header: Authorization: auth
// The response contains only the claim (adult status) — no identifiers