API Manager Guide

Back Next

How API consumers invoke an API with OAuth 2.0 authentication

To invoke a managed API where OAuth 2.0 authentication is enabled, API consumers generate an OAuth 2.0 authorization token and send the token to the managed API.

The following sections describe the stages of invoking a managed API that uses OAuth 2.0 authentication:

Generating an OAuth 2.0 authorization token: To generate the token, API consumers authenticate to the IDMC OAuth 2.0 server using the server URL and the OAuth 2.0 client credentials that you send to the
API Portal
administrator.
API consumers use one of the following methods to provide the client credentials to the OAuth 2.0 server, based on the application or software package that they use to invoke the API:

Enter the authentication header value as
Basic
. Select
Client Credentials
in the
Grant Type
field and enter the URL in the
Access Token URL
field.
Enter the OAuth 2.0 client ID and secret separately, as plain text.
For example, in Postman, enter the details as follows and add them to the request body as URL-encoded data:

Key
Value

client_id
Client name

client_secret
Client secret

grant_type
client_credentials

You can find the access token URLs on the
Authorization
tab in the
Configuration
page.

An access token POST URL has the following format:

{protocol}://{Host_URL}/authz-service/oauth/token

The following image shows a sample POST URL and other details:

Enter the
client_id
and the
client_secret
as authentication header values encoded in a combined Base64 Basic authorization header. Select
Client Credentials
in the
grant_type
field add them to the request body as URL-encoded data, and enter the URL in the
Access Token URL
field.

The following image shows an API invocation through Postman with a Basic authorization header:
Sending the token to the managed API: API consumers pass the token that they receive from the OAuth 2.0 server to the managed API as an Authorization header with the prefix
Bearer
followed by the token.
The following image shows an API invoked through Postman with a Bearer Token authorization type and the token that the API consumer entered: