# Generate PKCE code verifier and challenge
CODE_VERIFIER=$(openssl rand -base64 32 | tr -d "=+/" | cut -c1-43)
CODE_CHALLENGE=$(echo -n $CODE_VERIFIER | openssl dgst -sha256 -binary | base64 | tr -d "=+/" | cut -c1-43)

# Redirect user to OAuth authorization with PKCE
https://api.onboarder.com/api/v1/oauth/authorize?\
  client_id=YOUR_CLIENT_ID&\
  flow_id=YOUR_FLOW_ID&\
  redirect_uri=https://yourapp.com/callback&\
  response_type=code&\
  state=random_state&\
  code_challenge=$CODE_CHALLENGE&\
  code_challenge_method=S256

# After user completes verification, exchange code for token with PKCE
curl -X POST https://api.onboarder.com/api/v1/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "authorization_code",
    "code": "AUTHORIZATION_CODE",
    "client_id": "YOUR_CLIENT_ID",
    "client_secret": "YOUR_CLIENT_SECRET",
    "redirect_uri": "https://yourapp.com/callback",
    "code_verifier": "'$CODE_VERIFIER'"
  }'

{
  "sub": "user_123",
  "email": "user@example.com",
  "email_verified": true,
  "phone": "+1234567890",
  "phone_verified": true,
  "name": "John Doe",
  "given_name": "John",
  "family_name": "Doe",
  "picture": "https://...",
  "biometricIdentityId": "OBD-123456",
  "faceEnrolled": true,
  "voiceEnrolled": true,
  "verifications": {
    "email": {
      "verified": true,
      "verifiedAt": "2025-01-15T10:30:00Z"
    },
    "phone": {
      "verified": true,
      "verifiedAt": "2025-01-15T10:30:00Z"
    },
    "document": {
      "verified": true,
      "verifiedAt": "2025-01-15T10:30:00Z",
      "documentType": "passport",
      "documentCountry": "US",
      "documentNumber": "X12345678",
      "dateOfBirth": "1990-01-15"
    },
    "biometric": {
      "faceEnrolled": true,
      "voiceEnrolled": true,
      "identityId": "OBD-123456"
    }
  }
}