PKCE

import { generatePkce } from '@grantex/sdk';

const pkce = generatePkce();

console.log(pkce.codeVerifier);         // Random 43-character base64url string
console.log(pkce.codeChallenge);        // SHA-256 hash of the verifier, base64url-encoded
console.log(pkce.codeChallengeMethod);  // 'S256'

import { Grantex, generatePkce } from '@grantex/sdk';

const grantex = new Grantex({ apiKey: process.env.GRANTEX_API_KEY });
const pkce = generatePkce();

// Store codeVerifier securely (e.g. in a session)
session.codeVerifier = pkce.codeVerifier;

const authRequest = await grantex.authorize({
  agentId: agent.id,
  userId: 'user_abc123',
  scopes: ['calendar:read', 'payments:initiate:max_500'],
  expiresIn: '24h',
  redirectUri: 'https://yourapp.com/auth/callback',
  codeChallenge: pkce.codeChallenge,
  codeChallengeMethod: pkce.codeChallengeMethod,
});

// Redirect the user to authRequest.consentUrl

// In your /auth/callback handler:
const token = await grantex.tokens.exchange({
  code: req.query.code,
  agentId: agent.id,
  codeVerifier: session.codeVerifier,  // proves possession of the original challenge
});

console.log(token.grantToken);