Skip to content

OAuth2 Client Credentials Flow

The client credentials flow lets applications exchange a set of client credentials for an OAuth2 access token.

client-credentials-flow

The client may use client credentials such as API-keys or JWT signature, or a session Bearer token, depending on how it is previously authenticated.

The script should first fetch an access token from the Argus OAuth Token endpoint

1
curl -XPOST -H"Argus-API-Key: my/api/key" https://api.mnemonic.no/authentication/v1/oauth/token -d client_id=04d45a6b-05a1-4bed-8181-5c5d46d4f64e -d grant_type=client_credentials

Argus will respond with an access token:

1
{"access_token":"myUserName/ckEgvr23mT8PfPMPddVY7wYuuE6t6YmKLKr7tu3pV8ajvbGHzuJ9crvwoPFUBj9o","id_token":null,"refresh_token":null,"token_type":"Bearer","expires_in":300}

The script should then use this token as an Authorization:Bearer header towards the client application:

1
curl -XPOST -H"Authorization:Bearer myUserName/ckEgvr23mT8PfPMPddVY7wYuuE6t6YmKLKr7tu3pV8ajvbGHzuJ9crvwoPFUBj9o" https://my.application/dosomething

The client application may invoke the Argus token endpoint to verify the token, or invoke any permitted Argus endpoint using this bearer token.

1
curl -XGET -H"X-Forwarded-For: 94.127.56.1" -H"Authorization:Bearer myUserName/ckEgvr23mT8PfPMPddVY7wYuuE6t6YmKLKr7tu3pV8ajvbGHzuJ9crvwoPFUBj9o" https://api.mnemonic.no/authentication/v1/oauth/userinfo

Warning

The client MUST forward the user agents origin IP using the X-Forwarded-For header when invoking an Argus API, as Argus will verify that this IP corresponds with the IP used to create the access token.