volvo-api-core/com.github.ayastrebov.volvo.api.core/Pkce

Pkce

PKCE (Proof Key for Code Exchange) parameters for the OAuth2 authorization code flow.

All new Volvo Developer Portal applications enforce PKCE. Generate a Pkce instance for each authorization request and include the parameters in the authorization and token exchange steps.

Step 1 — Authorization request: Include codeChallenge and codeChallengeMethod as query parameters when redirecting to the Volvo ID login page.

Step 2 — Token exchange: Include codeVerifier in the token request body.

val pkce = Pkce.generate()

// Step 1: Build authorization URL
val authUrl = "https://volvoid.eu.volvocars.com/as/authorization.oauth2" +
    "?response_type=code" +
    "&client_id=$clientId" +
    "&redirect_uri=$redirectUri" +
    "&scope=openid conve:vehicle_relation" +
    "&code_challenge=${pkce.codeChallenge}" +
    "&code_challenge_method=${pkce.codeChallengeMethod}"

// Step 2: Exchange code for tokens (include code_verifier)
// POST to token endpoint with: grant_type=authorization_code&code=...&code_verifier=${pkce.codeVerifier}