OAuth is an industry-standard protocol for access delegation, commonly used to enable applications to access resources on behalf of a user. Below is a quick guide to using OAuth with our API:

🔐 OAuth 2.0 Flow

  1. Authorization Request
    Redirect the user to: 

    https://api.example.com/auth?response_type=code&client_id=YOUR_CLIENT_ID&redirect_uri=YOUR_REDIRECT_URI&scope=read

    📌 This will trigger the OAuth authorization code flow

  2. User Consent
    The user logs in and grants permissions.

    OAuth_User_Consent

  3. Token Exchange
    Exchange the authorization code for an access token: 

    POST /token HTTP/1.1
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code&code=AUTHORIZATION_CODE&redirect_uri=YOUR_REDIRECT_URI&client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET

📦 Supported Grant Types

  • Authorization Code (Recommended for web apps)
  • Implicit (Suitable for single-page apps)
  • Password (For trusted clients)
  • Client Credentials (For server-to-server communication)

📌 Example Request

GET /api/data HTTP/1.1
Authorization: Bearer YOUR_ACCESS_TOKEN

⚠️ Security Best Practices

  • Always use HTTPS to protect credentials
  • Store client secrets securely (never in client-side code)
  • Validate the state parameter to prevent CSRF attacks
  • Rotate tokens regularly

For deeper technical details, refer to our OAuth Quick Start Guide.

OAuth_Security