API Manager Guide

Back Next

How API consumers invoke an API with OAuth 2.0 authentication

To invoke a managed API where OAuth 2.0 authentication is enabled, API consumers generate an OAuth 2.0 authorization token and send the token to the managed API.

The following sections describe the stages of invoking a managed API that uses OAuth 2.0 authentication:

Generating an OAuth 2.0 authorization token: To generate the token, API consumers authenticate to the IDMC OAuth 2.0 server using the server URL and the OAuth 2.0 client credentials that you send to the
API Portal
administrator.
API consumers need to submit the following credential information to the OAuth 2.0 server:
client_id=<client_name>
client_secret=<client_secret>
grant_type=<client_credentials>
You can submit this information using any of the following methods. Choose the method that works best based on the application or software package that you use to invoke the API.

Method 1. Enter the
client_id
and
client_secret
in a Basic Authorization header. For the
grant_type
, add these to the request body as URL-encoded values. To do this, select
client_credentials
and add this to the request body as URL-encoded data, and enter the URL in the
Access Token URL
field.
Method 2. Enter the
client_id
and
client_secret
in a Basic Authorization header. For the
grant_type
, add these to the URL parameter.
Method 3. Enter the
client_id
,
client_secret
, and
grant_type
all within the request body as URL-encoded values.
For example, in Postman enter the details as follows and add them to the request body as URL-encoded data:

Key
Value

client_id
<client_name>

client_secret
<client_secret>

grant_type
<client_credentials>

You can find the access token URLs on the
Authorization
tab in the
Policies
page.

An access token POST URL uses the following format:

{protocol}://{host_URL}/authz-service/oauth/token

The following image shows a sample POST URL and other details:

Method 4. Enter the
client_id
and
client_secret
to the request body as URL-encoded data. For the
grant_type
, add these to the URL parameter.

Other combinations such as passing all three parameters in URL are supported but not recommended for security reasons.

If the parameters are duplicated and passed both in the URL and request body, the request body parameters override the URL parameters.

The following image shows an API invocation through Postman with a Basic Authorization header:
Sending the token to the managed API: API consumers pass the token that they receive from the OAuth 2.0 server to the managed API as an Authorization header with the prefix
Bearer
followed by the token.
The following image shows an API invoked through Postman with a Bearer Token authorization type and the token that the API consumer entered: