> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rebellapp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# my.getAuthCode

> Get an authorization code for user authentication.

Request user authorization and get an authorization code for backend token exchange.

## Parameters

| Property | Type     | Required | Description                                                                                                                                                                  |
| -------- | -------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| scopes   | Array    | No       | Authorization scopes to request. Defaults to `['auth_base']`. Must be an array — passing a plain string will cause a parse error or unexpected failure on some SDK versions. |
| success  | Function | No       | Callback with auth code                                                                                                                                                      |
| fail     | Function | No       | Callback on failure                                                                                                                                                          |
| complete | Function | No       | Callback that always executes                                                                                                                                                |

## Authorization Scopes

| Scope                   | Data Accessible                                |
| ----------------------- | ---------------------------------------------- |
| `auth_base`             | User ID only (default, silent where permitted) |
| `auth_user`             | Full user profile                              |
| `USER_NICKNAME`         | Display name                                   |
| `USER_NAME`             | First and last name                            |
| `USER_LOGIN_ID`         | Login identifier                               |
| `USER_AVATAR`           | Avatar image URL                               |
| `USER_GENDER`           | Gender                                         |
| `USER_BIRTHDAY`         | Date of birth                                  |
| `USER_NATIONALITY`      | Nationality                                    |
| `USER_PHONE_NUMBER`     | Phone number                                   |
| `USER_SHIPPING_ADDRESS` | Shipping address                               |
| `USER_RESIDENT_ADDRESS` | Resident address                               |
| `NOTIFICATION_INBOX`    | Inbox message permission                       |
| `NOTIFICATION_PUSH`     | Push notification permission                   |
| `codice_fiscale`        | Italian tax identification code                |

<Note>
  Silent authorization (`auth_base` without a prompt) is only available for first-party Mini Programs. All third-party Mini Programs require explicit user authorization.
</Note>

## Success Callback

| Property          | Type   | Description                            |
| ----------------- | ------ | -------------------------------------- |
| authCode          | String | Short-lived authorization code         |
| authSuccessScopes | Array  | Successfully authorized scopes         |
| authErrorScopes   | Object | Scopes that were denied and the reason |

## Fail Callback

| Property        | Type   | Description                                                                                                                          |
| --------------- | ------ | ------------------------------------------------------------------------------------------------------------------------------------ |
| error           | Number | Error code                                                                                                                           |
| errorMessage    | String | Human-readable error description                                                                                                     |
| authErrorScopes | Object | Scopes that were denied and the reason. Only present when specific scopes are rejected (error code 2). Not present for error code 3. |

## Error Codes

| Code | Description                                                                                                                                                                                                                                                                                                                                                      |
| ---- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 2    | Invalid parameters — check the `scopes` value and format                                                                                                                                                                                                                                                                                                         |
| 3    | Authorization service error — the SuperApp host's OAuthService could not complete the request. Common causes: no logged-in user session in the SuperApp, or the test user does not exist in the environment being targeted (e.g. using a sandbox user against a production endpoint, or vice versa). When this error occurs, `authErrorScopes` is not populated. |
| 10   | Network timeout                                                                                                                                                                                                                                                                                                                                                  |
| 11   | User cancelled authorization                                                                                                                                                                                                                                                                                                                                     |

## Code Example

```javascript theme={null}
my.getAuthCode({
  scopes: ['auth_user'],
  success: (res) => {
    console.log('Auth code:', res.authCode);
    // Send to backend for token exchange
    this.sendToBackend(res.authCode);
  },
  fail: (err) => {
    console.error('Authorization failed — code:', err.error, err.errorMessage);
    // authErrorScopes is only present for error code 2 (scope rejection), not code 3
    if (err.authErrorScopes) {
      console.error('Denied scopes:', err.authErrorScopes);
    }
  }
});
```

<Warning>
  The `authCode` is short-lived and single-use. It must be exchanged server-side via the Rebell OpenAPI for a user context. Never validate the authCode client-side.
</Warning>

## Related APIs

<CardGroup cols={2}>
  <Card title="my.getOpenUserInfo" icon="user" href="/jsapi/open-capabilities/my.getOpenUserInfo">
    Get user information
  </Card>

  <Card title="Backend Authentication" icon="shield" href="/mini-app/backend-authentication">
    Auth code exchange guide
  </Card>
</CardGroup>