> ## Documentation Index
> Fetch the complete documentation index at: https://developers.authlete.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Ticket Parameter in Authorization Endpoint

> Backend APIs for implementing an authorization endpoint with a ticket parameter that links two types of APIs and expires within 24 hours.

Authlete's [Authorization Endpoint APIs](/api-reference/authorization-endpoint)
are backend APIs to implement an authorization endpoint. The APIs are comprised of two types of APIs:

1. API that understands authorization requests and provides information that will be required in the next step, such as end-user authentication, and

   * [/auth/authorization](/api-reference/authorization-endpoint/process-authorization-request)

2. API that issues tokens or codes, or returns errors

   * [/auth/authorization/fail](/api-reference/authorization-endpoint/fail-authorization-request)
     , [/auth/authorization/issue](/api-reference/authorization-endpoint/issue-authorization-response)

These two APIs are linked using "ticket."

First, Authlete /auth/authorization API returns ticket in its response to authorization requests. Then, auth/authorization/issue or auth/authorization/fail API receives the ticket and process the authorization requests to issue tokens or codes or return errors.\\

<img src="https://mintcdn.com/authlete/EJDZNZMvOu_9CJHJ/configuration-reference/tokens-and-claims/authorization-endpoint.png?fit=max&auto=format&n=EJDZNZMvOu_9CJHJ&q=85&s=bdfb6fe2fc516bc662528907d1d1c9be" alt="authorization-endpoint" width="1024" height="492" data-path="configuration-reference/tokens-and-claims/authorization-endpoint.png" />

Here is a couple of nature of the ticket.

* A ticket will be expired in 24 hours. Expired tickets will be deleted from Authlete's database.
* A ticket can only be used once. It will be removed from the database right after /auth/authorization/issue or /auth/authorization/fail API successfully processed a request including the ticket.
* When you use a ticket that has already been used or expired, you will get an error code like below:

```
[A041202] There is no entity having the ticket specified
in the /api/auth/authorization/issue request (ticket = {Ticket}).
```

* Please note that tickets are designed to be used only between an authorization server and Authlete server; It must thus not be used between an authorization server and user agent, such as web browser, to manage sessions, for example.