...
where deployment and username are specific to the end-user and || is concatentationconcatenation.
The installed application can then exchange the PIN for an access and refresh token by presenting its client_id and client_secret along with the PIN.
...
Below is a table of accepted query parameters. The mandatory optional fields are underlined.
| Parameter | Values | Description |
|---|---|---|
| client_id | The applications client id obtained from the API Control Panel. | Indicates what API application is making the request. It is a unique string allocated to your application, which can be used across multiple deployments. For example: 34ad67fa2f@hq.local.affinitylive.com |
| response_type | code | This value must be code for installed applications. |
| scope | The permissions your application requests. | A scope is used to convey what permissions your application requires when requesting permission from the end-user. Current available scopes are:
Scope resources can be any of our endpoints. For example, companies, contacts or issues. The scope can be concatenated and delimited by a comma. For example:
|
...
When accessing the token endpoint it is recommended you authenticate yourself using HTTP Basic Authentication using the client_id and client_secret as username and password. The AffinityLive OAuth 2.0 does support sending the client_id and client_secret as query paramaters parameters as a last option.
The table below contains the token paramatersparameters.
| Parameter | Values | Description |
|---|---|---|
| grant_type | authorization_code | This is required when requesting access using an authorization grant. Note. You can send refresh_token to indicate that you are using a refresh token. In this situation, you should also send the refresh_token. |
| code | The code obtained during the authorization request. | This code was obtained during the authorization request and is used to obtain an access token. |
| redirect_uri | The redirect uri passed in the authorization request. | This must be the same as the uri passed during the authorization, failure to do so will result in an invalid_grant error. |
...
Once the application has obtained an access token, it can use it to access AffinityLive's Resource endpoints by including it in either a _bearer_token query parameter or as a (prefered preferred method) HTTP Authorization: Bearer header.
...
| Code Block | ||
|---|---|---|
| ||
GET https://hq.local.affinitylive.com/public_api/v0/companies/1?_bearer_token=frLA0s1m_D |
Sample using the prefered preferred Authorization header method:
...
...