Identity as a Service:M2M client token call examples

Choose an authentication method

All methods POST to the same token endpoint. Select the method that matches your application's credential type.

Prerequisites

Before you begin, make sure you have:

• An IDaaS EIAM instance with M2M configured

• An application ID (client_id) and, depending on your method, the corresponding credentials (client secret, private key, or certificate)

• At least one resource server and scope configured in IDaaS EIAM

• The token endpoint URL for your instance: https://<instance-id>.aliyunidaas.com/api/v2/iauths_system/oauth2/token

Token endpoint

All methods send a POST request to the same endpoint:

POST https://<instance-id>.aliyunidaas.com/api/v2/iauths_system/oauth2/token

Authentication methods

curl --request POST \
     --url 'https://<instance-id>.aliyunidaas.com/api/v2/iauths_system/oauth2/token' \
     --header 'Authorization: Basic <base64-encoded-client-id-and-secret>' \
     --header 'Content-Type: application/x-www-form-urlencoded' \
     --data-urlencode 'grant_type=client_credentials' \
     --data-urlencode 'scope=api://api.example.com|read:file'

{
  "token_type": "Bearer",
  "access_token": "AT8csE2sep******HBkxxHUG",
  "expires_in": 3600,
  "expires_at": 1733710213
}

curl --request POST \
     --url 'https://<instance-id>.aliyunidaas.com/api/v2/iauths_system/oauth2/token' \
     --header 'Content-Type: application/x-www-form-urlencoded' \
     --data-urlencode 'grant_type=client_credentials' \
     --data-urlencode 'client_id=<your-client-id>' \
     --data-urlencode 'client_secret=<your-client-secret>' \
     --data-urlencode 'scope=api://api.example.com|read:file'

{
  "token_type": "Bearer",
  "access_token": "AT8csE2******kxxHUG",
  "expires_in": 3600,
  "expires_at": 1733710213
}

curl --request POST \
     --url 'https://<instance-id>.aliyunidaas.com/api/v2/iauths_system/oauth2/token' \
     --header 'Content-Type: application/x-www-form-urlencoded' \
     --data-urlencode 'client_id=<your-client-id>' \
     --data-urlencode 'grant_type=client_credentials' \
     --data-urlencode 'client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer' \
     --data-urlencode 'client_assertion=<your-jwt-token>' \
     --data-urlencode 'scope=api://api.example.com|read:file'

{
  "token_type": "Bearer",
  "access_token": "AT8csE2se******NHBkxxHUG",
  "expires_in": 3600,
  "expires_at": 1733710213
}

curl --request POST \
     --url 'https://<instance-id>.aliyunidaas.com/api/v2/iauths_system/oauth2/token' \
     --header 'Content-Type: application/x-www-form-urlencoded' \
     --data-urlencode 'client_id=<your-client-id>' \
     --data-urlencode 'grant_type=client_credentials' \
     --data-urlencode 'client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer' \
     --data-urlencode 'client_assertion=<your-jwt-token>' \
     --data-urlencode 'scope=api://api.example.com|read:file'

{
  "token_type": "Bearer",
  "access_token": "AT8csE2sep******NHBkxxHUG",
  "expires_in": 3600,
  "expires_at": 1733710213
}

curl --request POST \
     --url 'https://<instance-id>.aliyunidaas.com/api/v2/iauths_system/oauth2/token' \
     --header 'Content-Type: application/x-www-form-urlencoded' \
     --data-urlencode 'client_id=<your-client-id>' \
     --data-urlencode 'grant_type=client_credentials' \
     --data-urlencode 'scope=api://api.example.com|.all' \
     --data-urlencode 'application_federated_credential_name=<federated-credential-name>' \
     --data-urlencode 'client_assertion=<your-oidc-token>' \
     --data-urlencode 'client_assertion_type=urn:cloud:idaas:params:oauth:client-assertion-type:id-token-bearer'

{
  "token_type": "Bearer",
  "access_token": "AT8csE2sep******7NHBkxxHUG",
  "expires_in": 3600,
  "expires_at": 1733710213
}

curl --request POST \
     --url 'https://<instance-id>.aliyunidaas.com/api/v2/iauths_system/oauth2/token' \
     --header 'Content-Type: application/x-www-form-urlencoded' \
     --data-urlencode 'client_id=<your-client-id>' \
     --data-urlencode 'grant_type=client_credentials' \
     --data-urlencode 'scope=api://api.example.com|.all' \
     --data-urlencode 'application_federated_credential_name=<federated-credential-name>' \
     --data-urlencode 'client_assertion=<your-pkcs7-signature>' \
     --data-urlencode 'client_assertion_type=urn:cloud:idaas:params:oauth:client-assertion-type:pkcs7-bearer'

{
  "token_type": "Bearer",
  "access_token": "AT8csE2sep******7NHBkxxHUG",
  "expires_in": 3600,
  "expires_at": 1733710213
}

curl --request POST \
     --url 'https://<instance-id>.aliyunidaas.com/api/v2/iauths_system/oauth2/token' \
     --header 'Content-Type: application/x-www-form-urlencoded' \
     --data-urlencode 'client_id=<your-client-id>' \
     --data-urlencode 'grant_type=client_credentials' \
     --data-urlencode 'scope=api://api.example.com|.all' \
     --data-urlencode 'application_federated_credential_name=<federated-credential-name>' \
     --data-urlencode 'client_assertion=<your-jwt-token>' \
     --data-urlencode 'client_assertion_type=urn:cloud:idaas:params:oauth:client-assertion-type:x509-jwt-bearer'

{
  "token_type": "Bearer",
  "access_token": "AT8csE2sepE******7NHBkxxHUG",
  "expires_in": 3600,
  "expires_at": 1733710213
}

Error codes

Appendix 1: Generate a JWT signature using Java (RS256 algorithm)

Use this example to generate the client_assertion JWT for the private_key_jwt authentication method. The JWT is signed with an RSA private key using the RS256 algorithm.

Maven dependencies

<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-api</artifactId>
    <version>0.11.5</version>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-impl</artifactId>
    <version>0.11.5</version>
    <scope>runtime</scope>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-jackson</artifactId>
    <version>0.11.5</version>
    <scope>runtime</scope>
</dependency>

Java code example

import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;

import java.security.Key;
import java.util.Date;
import java.util.HashMap;
import java.util.Map;
import java.util.UUID;

public class JwtGenerator {
    private static final String PRIVATE_KEY = "your-private-key"; // Replace with your private key

    // Enter the client_id of your application
    private static final String ISSUER = "your_client_id";

    // Enter the client_id of your application
    private static final String SUBJECT = "your_client_id";

    // Enter the token endpoint of your application
    private static final String AUDIENCE = "your_token_endpoint";

    public static void main(String[] args) throws Exception {
        // Key
        Key securityKey = RsaKeyConverter.getPrivateKeyFromString(PRIVATE_KEY);

        Map<String, Object> claims = new HashMap<>();
        claims.put("jti", UUID.randomUUID().toString()); // Anti-replay jti

        // Set the expiration time. It cannot exceed 30 minutes.
        long expirationTime = 1000 * 60 * 30;
        Date expirationDate = new Date(System.currentTimeMillis() + expirationTime);

        // Generate the JWT
        String jwt = Jwts.builder()
                .setClaims(claims)
                .setIssuedAt(new Date())
                .setExpiration(expirationDate)
                .setSubject(SUBJECT)
                .setIssuer(ISSUER)
                .setAudience(AUDIENCE)
                .signWith(securityKey, SignatureAlgorithm.RS256)
                .compact();

        System.out.println("Generated JWT:");
        System.out.println(jwt);
    }
}

import java.security.KeyFactory;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.spec.PKCS8EncodedKeySpec;
import java.security.spec.X509EncodedKeySpec;
import java.util.Base64;

public class RsaKeyConverter {

    public static PrivateKey getPrivateKeyFromString(String privateKeyStr) throws Exception {
        // Remove the PEM format header and footer
        String privateKeyPEM = privateKeyStr
                .replace("-----BEGIN PRIVATE KEY-----", "")
                .replace("-----END PRIVATE KEY-----", "")
                .replaceAll("\\s+", "");  // Remove all whitespace characters

        // Base64 decode
        byte[] encoded = Base64.getDecoder().decode(privateKeyPEM);

        // Generate the private key using PKCS8EncodedKeySpec
        PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(encoded);
        KeyFactory keyFactory = KeyFactory.getInstance("RSA");
        return keyFactory.generatePrivate(keySpec);
    }

    public static PublicKey getPublicKeyFromString(String publicKeyStr) throws Exception {
        // Remove the PEM format header and footer
        String publicKeyPEM = publicKeyStr
                .replace("-----BEGIN PUBLIC KEY-----", "")
                .replace("-----END PUBLIC KEY-----", "")
                .replaceAll("\\s+", "");  // Remove all whitespace characters

        // Base64 decode
        byte[] encoded = Base64.getDecoder().decode(publicKeyPEM);

        // Generate the public key using X509EncodedKeySpec
        X509EncodedKeySpec keySpec = new X509EncodedKeySpec(encoded);
        KeyFactory keyFactory = KeyFactory.getInstance("RSA");
        return keyFactory.generatePublic(keySpec);
    }
}

Appendix 2: Generate a JWT signature using Java (HS256 algorithm)

Use this example to generate the client_assertion JWT for the client_secret_jwt authentication method. The JWT is signed with the client_secret using the HS256 algorithm.

Maven dependencies

<dependency>
  <groupId>io.jsonwebtoken</groupId>
  <artifactId>jjwt-api</artifactId>
  <version>0.11.5</version>
</dependency>
<dependency>
  <groupId>io.jsonwebtoken</groupId>
  <artifactId>jjwt-impl</artifactId>
  <version>0.11.5</version>
  <scope>runtime</scope>
</dependency>
<dependency>
  <groupId>io.jsonwebtoken</groupId>
  <artifactId>jjwt-jackson</artifactId>
  <version>0.11.5</version>
  <scope>runtime</scope>
</dependency>

Java code example

public class JwtGenerator {

    private static final String SECRET_KEY = "your_secret_key"; // Replace with your secret key

    // Enter the client_id of your application
    private static final String ISSUER = "your_client_id";

    // Enter the client_id of your application
    private static final String SUBJECT = "your_client_id";

    // Enter the token endpoint of your application
    private static final String AUDIENCE = "your_token_endpoint";

    public static String generateJwt() throws Exception {
        SecretKey secretKey = Keys.hmacShaKeyFor(SECRET_KEY.getBytes());

        Map<String, Object> claims = new HashMap<>();
        claims.put("jti", UUID.randomUUID().toString()); // Anti-replay jti

        // Set the expiration time. It cannot exceed 30 minutes.
        long expirationTime = 1000 * 60 * 30;
        Date expirationDate = new Date(System.currentTimeMillis() + expirationTime);

        // Generate the JWT
        String jwt = Jwts.builder()
                .setClaims(claims)
                .setIssuedAt(new Date())
                .setExpiration(expirationDate)
                .setSubject(SUBJECT)
                .setIssuer(ISSUER)
                .setAudience(AUDIENCE)
                .signWith(secretKey, SignatureAlgorithm.HS256)
                .compact();
        return jwt;
    }

    public static void main(String[] args) throws Exception{
        // Generate the JWT
        String jwt = generateJwt();
        System.out.println("Generated JWT: " + jwt);
    }
}