code to request an access token and refresh token pair from the authorization server. Alexa uses the refresh token to request a new access token after the old access token expires.
The Alexa service implements Proof Key for Code Exchange (PKCE) security measures in the authorization code grant account linking flow. This process verifies that the token request comes from the same client that initiated the authorization request.
The Alexa Skills Kit supports authorization code grants for account linking in custom, smart home, video, and music skills. For details about how the authorization code grant flow works at runtime, see Standard Account Linking.
Prerequisites
Make sure that you have an authorization server that meets the requirements described in Requirements for Account Linking. Before you start, make sure you have the following items:- Amazon developer account.
- Alexa skill that supports account linking (smart home add-on, video skill, custom skill, or music skill).
Gather your account linking information
You can turn on account linking in the Alexa developer console on the Build > Account Linking page. Or, you can configure account linking with the ASK CLI or the Account Linking REST API.Account linking settings
Under Settings, you enable and disable the account linking options available to your skill. The service provider options in the next section are based on the settings that you enable here. The following table describes the settings fields to configure account linking.| Field | Description |
|---|---|
| Do you allow users to create an account or link to an existing account with you? | Turn on to enable account linking for a custom skill. This option is automatically selected for smart home and video skills. |
| Allow users to enable the skill without account linking (Recommended) | Turn on to let users bypass the account linking flow when they enable your skill. Available for custom skills only. This option is useful if your skill offers meaningful functionality without an account, in addition to the features that require an account. For more details, see Let Users Enable Your Skill without Account Linking.This option is on by default. |
| Allow users to link their account to your skill from within your application or website | Turn on to allow users to authenticate by using your website. |
| Allow users to authenticate using your mobile application | Turn on to enable app-to-app account linking and allow users to authenticate by using your mobile app. |
| Allow users to link their account to your skill using voice | Turn on to enable customers to use their voice to link their Amazon account with the account they have with your service. |
Security provider information
Under Security provider information, select the authorization grant type, and then configure the service provider information as shown in the following table. The options displayed here are based on the settings that you enabled in the settings section. If you use a third-party OAuth provider, see the documentation for that provider to determine the values to enter in these fields.Configure account linking
You can turn on account linking in the Alexa developer console. Or, you can configure account linking with the ASK CLI or the Account Linking REST API. To configure account linking in the Alexa developer console- Sign in to the Alexa developer console.
- From the skill list, under STATUS, locate the development version of your skill, and then, in the dropdown under ACTIONS, select Edit.
- Navigate to ACCOUNT LINKING.
- Under Settings, enable and disable the account linking options available to your skill.
- Under Security provider information, select the authorization grant type, and then configure the service provider information
- To save the account linking configuration, choose Save.
