Overview
BBaton Login runs on OAuth 2.0, the global standard authentication protocol. The structure is simple — authorization code → token → user info. Three steps, that is all.
01 How BBaton Login executes
BBaton Login is an open API you can implement to fit your web policy and UI/UX. Understand it through three steps — authorization code request, token request, and user info request — and the whole structure falls into place.
The token request must come before the user info request. Login success alone is not the end — you can call user APIs only after exchanging the authorization code for a token.
FLOW 01
Request auth code
Your application requests an authorization code from the BBaton Server.
FLOW 02
Redirect delivery
After the user authenticates, the code is delivered to your Redirect URL.
FLOW 03
Request token
Your server exchanges the code for a token and receives the response.
FLOW 04
Request user info
Request user info with the issued token and receive it after verification.
Process
Between your application and the BBaton Server: 1) request auth code → 2) code delivered to Redirect URL → 3) request token with code → 4) token delivered → 5) request user info with token → 6) user info delivered.
02 Authentication & UX
At the authorization step, users verify adult status with their BBaton account ID and password. Adult status is handled as pseudonymized data under the Data 3 Act amendments effective August 5, 2020.
If the user is already signed in to BBaton, the code is delivered immediately without asking for credentials again. Desktop web login uses only account ID and password — no other factors.
03 Adoption order
Four steps, in order. Detailed parameters and code examples continue in Integration.
Order
Step
Purpose
Note
01
Request auth code
Login entry
User authentication
02
Receive code at Redirect URI
Code receipt
Server-side handling
03
Exchange code for token
Token issuance
Uses Basic auth
04
Request user info with token
API call
Bearer / token_type