Where should I look for the code for token exchange? I am getting an invalid token error for one particular identity provider, and wI want to see what sort of logic the code uses to decide whether to validate and swap tokens. I have my code working ok for a standard Google oauth provider, so I have already fixed issues with users not being enabled when I try to exchange tokens, and making sure I have a valid userinfo url. My suspicion is I have an error with the userinfo url - which is not a standard oidc endpoint, but it is returning a 200 OK status when I hit it by hand with the access token. Thanks, James ---- *James Mitchell* Developer e: jamesm(a)suitebox.com w: www.suitebox.com *SuiteBox |* Level 4, 8 Mahuhu Crescent, Auckland 1010, NZ