Identity as a Service:Authorization information

Server-side authentication

Use server-side authentication for API calls between servers. Acquire an access token with grant_type=client_credentials, then pass it on each request using one of the following formats:

Query parameter:

https://xxx/h5/login/pwd?access_token=eyJhbGciOiJIUzI1NiIs****......fiMzvKNaWAxKfHI-3NG

Request header (bearer token):

Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5......fiMzvKNaWAxKfHI-3NGndKzo_VOZjLoI

For details on the bearer token format, see RFC 6750.

Client-side authentication

Use client-side authentication only for authentication APIs running in browsers, apps, or miniapps. Add the following custom request headers to each call:

idaasSign: hex(sha1.encode(idaasAppId+idaasTimeStamp))
idaasAppId: <your Application ID from the IDaaS console>
idaasTimeStamp: new Date().getTime()

Where idaasSign is a hex-encoded SHA-1 signature of your Application ID concatenated with the current timestamp.

Scopes

The scope parameter controls what the token can access. Include one or more values, separated by spaces.

Client Credentials Grant

Gets a bearer token for server-to-server API authorization. No user context is involved and no refresh_token is returned.

Endpoint: POST /api/bff/v1.2/developer/ciam/oauth/token

Content-Type: application/json

Request parameters

Example request

curl --request POST \
  --url 'https://<your-domain>/api/bff/v1.2/developer/ciam/oauth/token' \
  --header 'Content-Type: application/json' \
  --data '{
    "client_id": "<your-appKey>",
    "client_secret": "<your-appSecret>",
    "grant_type": "client_credentials",
    "scope": "APPLICATION_API"
  }'

Replace the following placeholders:

Response parameters

Authorization Code Grant

Exchanges an authorization code for a user token. Use this when your app redirects users to CIAM for login and receives a code at the callback URL.

Endpoint: POST /api/bff/v1.2/developer/ciam/oauth/token

Content-Type: application/json

Request parameters

Example request

curl --request POST \
  --url 'https://<your-domain>/api/bff/v1.2/developer/ciam/oauth/token' \
  --header 'Content-Type: application/json' \
  --data '{
    "client_id": "<your-appKey>",
    "client_secret": "<your-appSecret>",
    "grant_type": "authorization_code",
    "scope": "USER_API openid",
    "code": "<authorization-code>",
    "redirect_uri": "<your-callback-url>"
  }'

Replace the following placeholders:

Response parameters

Implicit Grant

Gets a user token directly from the authorization endpoint. Use this for SPAs and other client-side apps with no server-side component.

Implicit Grant does not return a refresh_token.

Endpoint: GET /api/bff/v1.2/developer/ciam/oauth/authorize

Request parameters

Example request

GET {ciam.example.com}/api/bff/v1.2/developer/ciam/oauth/authorize?response_type=token&client_id=KnUPlQlqm
    &scope=USER_API%20APPLICATION_API%20read%20openid%20profile%20email&state=123
    &redirect_uri=https://xxxxx

Response parameters

Refresh token

Exchanges a refresh token for a new access token. Use this to maintain user sessions without requiring re-authentication.

Endpoint: POST /api/bff/v1.2/developer/ciam/oauth/token

Content-Type: application/json

Request parameters

Example request

curl --request POST \
  --url 'https://<your-domain>/api/bff/v1.2/developer/ciam/oauth/token' \
  --header 'Content-Type: application/json' \
  --data '{
    "client_id": "<your-appKey>",
    "client_secret": "<your-appSecret>",
    "grant_type": "refresh_token",
    "scope": "USER_API openid",
    "refresh_token": "<your-refresh-token>"
  }'

Response parameters