Get an access token
Sign a person in with the authorization code flow and exchange the code for tokens.
Send the person to sign in
Build the authorization URL with your client id, the redirect URI we registered for you, the three scopes, and a random state value you check when they come back. CurrentClient shows the sign-in page and redirects to your URI with a code in the query string.
https://auth.currentclient.com/oauth2/authorize
?response_type=code
&client_id=$CLIENT_ID
&redirect_uri=https://yourapp.example/callback
&scope=openid+profile+email
&state=$RANDOM_STATEconst params = new URLSearchParams({
response_type: "code",
client_id: CLIENT_ID,
redirect_uri: "https://yourapp.example/callback",
scope: "openid profile email",
state: randomState,
});
const signInUrl = `https://auth.currentclient.com/oauth2/authorize?${params}`;from urllib.parse import urlencode
params = {
"response_type": "code",
"client_id": CLIENT_ID,
"redirect_uri": "https://yourapp.example/callback",
"scope": "openid profile email",
"state": random_state,
}
sign_in_url = f"https://auth.currentclient.com/oauth2/authorize?{urlencode(params)}"Exchange the code for tokens
From your server, post the code to the token endpoint with your client id and secret as HTTP basic auth. Keep the secret on the server; never ship it in a browser or mobile app.
curl -X POST https://auth.currentclient.com/oauth2/token \
-u "$CLIENT_ID:$CLIENT_SECRET" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=authorization_code&code=$CODE&redirect_uri=https://yourapp.example/callback"const credentials = Buffer.from(`${CLIENT_ID}:${CLIENT_SECRET}`).toString("base64");
const res = await fetch("https://auth.currentclient.com/oauth2/token", {
method: "POST",
headers: {
Authorization: `Basic ${credentials}`,
"Content-Type": "application/x-www-form-urlencoded",
},
body: new URLSearchParams({
grant_type: "authorization_code",
code,
redirect_uri: "https://yourapp.example/callback",
}),
});
const { access_token, refresh_token, expires_in } = await res.json();import requests
res = requests.post(
"https://auth.currentclient.com/oauth2/token",
auth=(CLIENT_ID, CLIENT_SECRET),
data={
"grant_type": "authorization_code",
"code": code,
"redirect_uri": "https://yourapp.example/callback",
},
)
res.raise_for_status()
tokens = res.json()
token = tokens["access_token"]Read the response
You get an access token for the API, an id token describing the person, a refresh token, and how long the access token lives in seconds. Store the refresh token securely; it is what keeps the integration running.
{
"access_token": "eyJraWQiOiJ...",
"id_token": "eyJraWQiOiJ...",
"refresh_token": "eyJjdHkiOiJ...",
"token_type": "Bearer",
"expires_in": 3600
}Refresh before it expires
Trade the refresh token for a new access token with the same basic auth. Do this a little before expires_in runs out rather than on every call.
curl -X POST https://auth.currentclient.com/oauth2/token \
-u "$CLIENT_ID:$CLIENT_SECRET" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=refresh_token&refresh_token=$REFRESH_TOKEN"const res = await fetch("https://auth.currentclient.com/oauth2/token", {
method: "POST",
headers: {
Authorization: `Basic ${credentials}`,
"Content-Type": "application/x-www-form-urlencoded",
},
body: new URLSearchParams({ grant_type: "refresh_token", refresh_token }),
});
const { access_token, expires_in } = await res.json();res = requests.post(
"https://auth.currentclient.com/oauth2/token",
auth=(CLIENT_ID, CLIENT_SECRET),
data={"grant_type": "refresh_token", "refresh_token": refresh_token},
)
token = res.json()["access_token"]Use the access token on every request
Send the access token in the Authorization header. A missing or malformed token gets a 401 with a plain text body. The same token also works against the user info endpoint if you want the person's name and email.
curl https://api.currentclient.com/api/v1/profile \
-H "Authorization: Bearer $TOKEN"
curl https://auth.currentclient.com/oauth2/userInfo \
-H "Authorization: Bearer $TOKEN"const res = await fetch("https://api.currentclient.com/api/v1/profile", {
headers: { Authorization: `Bearer ${TOKEN}` },
});
const profile = await res.json();res = requests.get(
"https://api.currentclient.com/api/v1/profile",
headers={"Authorization": f"Bearer {TOKEN}"},
)
profile = res.json()