OAuth 2.0 - Obtaining an Access Token

Advertisements

Previous Page
Next Page  

An access token is a string that identifies a user, an application, or a page. The token includes information such as when the token will expire and which app created that token.

  • First, it is necessary to acquire OAuth 2.0 client credentials from API console.

  • Then, the access token is requested from the authorization server by the client.

  • It gets an access token from the response and sends the token to the API that you wish to access.

You must send the user to the authorization endpoint at the beginning. Following is an example of a dummy request

https://publicapi.example.com/oauth2/authorize?client_id=your_client_id&redirect_uri=your_url 
   &response_type=code

Following are the parameters and their descriptions.

  • client_id − It should be set to the client id of your application.

  • redirect_uri − It should be set to the URL. After the request is authorized, the user will be redirected back.

  • response_type − It can either be a code or a token. The code must be used for server side applications, whereas the token must be used for client side applications. In server side applications, you can make sure that the secrets are saved safely.

Following table lists the concepts of Client Credentials.

Sr.No. Concept & Description
1 Authorization Code

The authorization code allows accessing the authorization request and grants access to the client application to fetch the owner resources.
2 Resource Owner Password Credentials

The resource owner password credentials include only one request and one response, and is useful where the resource owner has a good relationship with the client.
3 Assertion

Assertion is a package of information that makes the sharing of identity and security information across various security domains possible.
4 Refresh Token

The refresh tokens are used to acquire a new access tokens, which carries the information necessary to get a new access token.
5 Access Token Response

Access token is a type of token that is assigned by the authorization server.
6 Access Token Error Response Codes

If the token access request, which is issued by the authorization server is invalid or unauthorized, then the authorization server returns an error response.
Advertisements