4. Get an Access Token

🌟 Key Concept: An Access Token﻿ is a credential granted by the Authorization Server that allows Client applications to access protected Resources from a Resource Server. 
This example setup shows how Clients can request, get, and use an Access Token from the IDENTOS Authorization Server.
TODO: Add overview diagram with step emphasized.
This setup will... TODO: Introduce example.
Prerequisites
You've created the example Resource Server from 1. Create a Basic Resource Server﻿﻿
You've created the example Resource from 2. Create a Basic Resource﻿﻿
You've created the example Client from 3. Create a Basic Client﻿﻿
Step-by-Step Setup
To get an Access Token from the Authorization Server, we'll need to...
Request an Access Token from the Authorization Server.
Get an Access Token from the Authorization Server's response.
Since we've already authorized our Client to access the blood-glucose-level Resource type, it doesn't need additional consent or authorization from an end user. As a result, all the Client has to do is request an Access Token from the Authorization Server, as outlined below.
1
Request an Access Token
Run the API call below to request an Access Token with the read scope from the Authorization Server.
Shell
curl -X POST --location '{{AS_ADMIN_URI}}/oauth2/token' \
-H 'Content-type: application/json' \
-H 'Authorization: Basic ZnB4c3A6c2VjcmV0'  \
-d '{
    "grant_type": "client_credentials",
    "scope" : "alec laws" #read?
}'

# No need for client authentication?
grant_type=client_credentials
&client_id=xxxxxxxxxx
&client_secret=xxxxxxxxxx
curl -X POST --location '{{AS_ADMIN_URI}}/oauth2/token' \
-H 'Content-type: application/json' \
-H 'Authorization: Basic ZnB4c3A6c2VjcmV0'  \
-d '{
    "grant_type": "client_credentials",
    "scope" : "alec laws" #read?
}'

# No need for client authentication?
grant_type=client_credentials
&client_id=xxxxxxxxxx
&client_secret=xxxxxxxxxx
﻿
2
Get an Access Token
A successful response from the Authorization Server will include the Access Token in the access_token property, as well as other details such as when the Access Token expires (expires_in) and what the available scopes are (scope).
Curl
HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: no-store

{
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJodHRwOlwvXC9sb2NhbGhvc3Q6ODA4NiIsInN1YiI6IkJ1Y1IzaGNnNDNRWUhObjYxN2psUEtUZW1IS0J4aFg1dnpxZmx5MG9PSkNFVkIzWEl1NmNycVRReUFpR3RWMWIiLCJyZXNvdXJjZV9vd25lciI6IjBhNDhmNTA5LWY0MjgtNDZjNi04ZWI5LTRkOTYwOWMwMTZmYiIsImlzcyI6Imh0dHA6XC9cL2xvY2FsaG9zdDo4MDg0IiwicmVzb3VyY2VfaWQiOiJvcGVuaWQiLCJncmFudGVkX3Njb3BlcyI6WyJyZWFkIl0sInR5cGUiOiJwZXJtaXNzaW9uIiwiZXhwIjoxNjU4MjMwNzMzLCJjbGllbnRfaWQiOiJvYXV0aF91bWFfY2xpZW50In0.FHWGOTFg0K06L1VhNasc-pKZ8OLCUB7clUbjwdSSIHs",
  "expires_in": 3599,
  "token_type": "Bearer",
  "refresh_token": "e0dd0169-36a9-4cf4-b30a-3b78c6162bc3",
  "scope": "read"
}
HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: no-store

{
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJodHRwOlwvXC9sb2NhbGhvc3Q6ODA4NiIsInN1YiI6IkJ1Y1IzaGNnNDNRWUhObjYxN2psUEtUZW1IS0J4aFg1dnpxZmx5MG9PSkNFVkIzWEl1NmNycVRReUFpR3RWMWIiLCJyZXNvdXJjZV9vd25lciI6IjBhNDhmNTA5LWY0MjgtNDZjNi04ZWI5LTRkOTYwOWMwMTZmYiIsImlzcyI6Imh0dHA6XC9cL2xvY2FsaG9zdDo4MDg0IiwicmVzb3VyY2VfaWQiOiJvcGVuaWQiLCJncmFudGVkX3Njb3BlcyI6WyJyZWFkIl0sInR5cGUiOiJwZXJtaXNzaW9uIiwiZXhwIjoxNjU4MjMwNzMzLCJjbGllbnRfaWQiOiJvYXV0aF91bWFfY2xpZW50In0.FHWGOTFg0K06L1VhNasc-pKZ8OLCUB7clUbjwdSSIHs",
  "expires_in": 3599,
  "token_type": "Bearer",
  "refresh_token": "e0dd0169-36a9-4cf4-b30a-3b78c6162bc3",
  "scope": "read"
}
﻿
3
Use the Access Token (Optional)
TBD (create example API call using access token for auth)
Curl
TBD
TBD
﻿
Next Steps
✅ You just got a basic Access Token from the Authorization Server! 
Next step: Proceed to 5. Enable Consent Management﻿ to learn how to add user consent to the authorization flow you just created.
Learn more: Read the Get an Access Token﻿ guide to learn more about getting Access Tokens from the Authorization Server.
Simple OAuth client w/ client_credntials grant_type
INSERT INTO oauth_client (id, version, date_created, last_updated, client_id, client_name, oauth_client_oauth_client_metadata_id)
VALUES
    (4, 0, '2024-04-12 01:03:36', '2024-04-12 01:03:36', 'fpxsp', 'FPX Service Provider', 4);
    
INSERT INTO oauth_client_metadata (id, version, date_created, last_updated, issuer_uri, client_authentication_type, client_type, grant_types, jwks_raw, jwks_uri, meta_data_raw, allowed_scopes, client_secret)
VALUES
    (4, 0, '2024-04-12 01:03:36.321000', '2024-04-12 01:03:36.321000', 'https://fpxsp.dev.identos.ca', 'client_secret_basic', 'CONFIDENTIAL', 'client_credentials', NULL, NULL, NULL, 'uma_protection alec laws', 'secret');

INSERT INTO oauth_client_redirect_uris (OAuthClient_id, redirect_uris)
VALUES
    (4, 'https://fpxsp.dev.identos.ca');


curl -X POST --location http://localhost:8081/oauth2/token \
-H 'Content-type: application/json' \
-H 'Authorization: Basic ZnB4c3A6c2VjcmV0'  \
-d '{
    "grant_type": "client_credentials",
    "scope" : "alec uma_protection"
}'


curl -X POST --location http://localhost:8081/oauth2/token \
-H 'Content-type: application/json' \
-H 'Authorization: Basic ZnB4c3A6c2VjcmV0'  \
-d '{
    "grant_type": "client_credentials",
    "scope" : "alec laws"
}'
{"access_token":"eyJraWQiOiJyc2ExIiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJzdWIiOiJmcHhzcCIsInNjb3BlIjoiYWxlYyBsYXdzIiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgxIiwiZXhwIjoxNzEyOTM0OTkyLCJpYXQiOjE3MTI5MzEzOTIsImp0aSI6ImJhYTg5MzIxLWJmMTUtNDUyOS1hODNlLTk3M2MxZWU2OGRiMyJ9.NQAL8cAs6rIVNdRj2gUSAeN-J4GRjIS23V_nNE8bccapRJq5jY4Xjm7Z-7bXA9ElURilbfC-32df_qRDqAgnO6kh9WHXuPXzo1BzSzx7NcndFnPTk_IyobEQeKdKDliXTnLq98z4In_UqJ-uWd7lz-HfPvoxov6nWHS0F6AeqhZO0P05Xb6gImeCZF_jP8iLzAjEFhYQ8ilQ11WpQ6ji1rXfvITriLyRp252EP2vYicX7--Ls9Kk_FSWJ2-dxp2F-iIcQwwy70dtodUmhFc5lmfi-5FevwNG6gqnjD79ktiZv6JtdHBSK-LoGlSrKyYje-lN8qghACVwhj5L4aI1Yw","expires_in":3599,"token_type":"Bearer","scope":"alec laws"}%

curl -X POST --location http://localhost:8081/oauth2/token \
-H 'Content-type: application/json' \
-H 'Authorization: Basic ZnB4c3A6c2VjcmV0'  \
-d '{
    "grant_type": "client_credentials",
    "scope" : "alec not_my_scope"
}'

->> error invalid scope
Updated 23 Apr 2024
Did this page help you?
3. Create a Basic Client
5. Enable Consent Management