Resource Owner Grant

Description
The Password grant type is used by first-party clients to exchange a user's credentials for an access token. Since this involves the client asking the user for their password, it should not be used by third party clients. In this flow, the user's username and password are exchanged directly for an access token. The application acts on behalf of the user. Refer to OAuth 2.0 spec for more details.
Basic scheme
Configure Client
The first step is to configure Client for Resource Owner Grant with secret and password grant type:
client
1
PUT /Client/myapp
2
Accept: text/yaml
3
Content-Type: text/yaml
4
​
5
secret: verysecret
6
grant_types:
7
  - password
Copied!
Client will act on behalf of the user, which means Access Policies should be configured for User, not for Client.
You can configure Client for JWT tokens, set token expiration and enable refresh token:
attribute
options
desc
auth.password.token_format
jwt
use access token in jwt format
auth.password.token_expiration
int (seconds)
token expiration time from issued at
auth.password.refresh_token
true/false
enable refresh_token
auth.password.secret_required
true/false
require client secret for token
Get Access Token
Next step is to collect username & password and exchange username, password, client id and secret (if required) for Access Token.
Using Basic & form-url-encoded:
using-basic
1
POST /auth/token
2
Authorization: Basic base64(client.id, client.secret)
3
Content-Type: application/x-www-form-urlencoded
4
​
5
grant_type=password&username=user&password=password
Copied!
Or by JSON request:
json-request
1
POST /auth/token
2
Content-Type: application/json
3
​
4
{
  "grant_type": "password",
5
  "client_id": "myapp",
6
  "client_secret": "verysecret",
7
  "username": "user",
8
  "password": "password"
9
}
Copied!
If provided credentials are correct, you will get a response with the access token, user information and refresh token (if enabled):
token-response
1
status: 200
2
​
3
{
4
 "token_type": "Bearer",
5
 "expires_in": 3600,
6
 "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEiLCJzdWIiOiJ1c2VyIiwiaWF0IjoxNTU0NDczOTk3LCJqdGkiOiI0ZWUwZDY2MS0wZjEyLTRlZmItOTBiOS1jY2RmMzhlMDhkM2QiLCJhdWQiOiJodHRwOi8vcmVzb3VyY2Uuc2VydmVyLmNvbSIsImV4cCI6MTU1NDQ3NzU5N30.lCdwkqzFWOe4IcXPC1dIB8v7aoZdJ0fBoIKlzCRFBgv4YndSJxGoJOvIPq2rGMQl7KG8uxGU0jkUVlKxOtD8YA",
7
 "refresh_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEiLCJzdWIiOiJwYXNzd29yZC1jbGllbnQiLCJqdGkiOiI0ZWUwZDY2MS0wZjEyLTRlZmItOTBiOS1jY2RmMzhlMDhkM2QiLCJ0eXAiOiJyZWZyZXNoIn0.XWHYpw0DysrqQqMNhqTPSdNamBM4ZDUAgh_VupSa7rkzdJ3uZXqesoAo_5y1naJZ31S92-DjPKtPEAyD_8PloA"
8
 "userinfo": {
9
  "email": "[email protected]",
10
  "id": "user",
11
  "resourceType": "User",
12
 },
13
}
Copied!
Use Access Token
You can use the access token in Authorization header for Aidbox API calls:
authorized-request
1
GET /Patient
2
Authorization: Bearer ZjQyNGFhY2EtNTY2MS00NjVjLWEzYmEtMjIwYjFkNDI5Yjhi
Copied!
1
curl -H 'Authorization: Bearer ZjQyNGFhY2EtNTY2MS00NjVjLWEzYmEtMjIwYjFkNDI5Yjhi' /Patient
Copied!
Revoke Access Token (Close Session)
Aidbox creates a Session resource for each Access Token, which can be closed with a special endpoint DELETE /Session with the token in the Authorization header:
close-session
1
DELETE /Session
2
Authorization: Bearer ZjQyNGFhY2EtNTY2MS00NjVjLWEzYmEtMjIwYjFkNDI5Yjhi
Copied!
Session is just a Resource and you can inspect and manipulate sessions by a standard Search & CRUD API. For example, to get all sessions: GET /Session
Auth Sandbox Demo
​
​

Client Credentials Grant

Authorization Code Grant

Last modified 2mo ago

Copy link

Contents

Configure Client

Get Access Token

Use Access Token

Revoke Access Token (Close Session)

Auth Sandbox Demo