OAuth 2.0 Client Credential Grant

The Client Credential Grant is used for authenticating machine-to-machine (M2M) applications. In this flow the Client ID and Client Secret of the OAuth application you registered in EmpowerID is sent to the Token endpoint in exchange for an access token and an ID token (when scope=openid). By default, the access token is issued for the owner of registered OAuth application. This article describes how to use this grant in your applications.

You can download sample .NET framework code at https://dl1.empowerid.com/files/OAuthTestSampleCode.zip

Client Credential Grant

1. Enable Client Credential Flow on the OAuth application as described in the Configured Advanced OAuth Flows documentation

2. Initiate a request to the EmpowerID Token endpoint, https://<EID Server>/oauth/v2/token

POST /oauth/v2/token HTTP/1.1
Host: <EID Server>
Content-Type: application/x-www-form-urlencoded
Cache-Control: no-cache
 
client_id={The Client ID of the OAuth app you registered in EmpowerID}
&client_secret={The Client Secret of the OAuth app you registered in EmpowerID}
&grant_type=client_credentials
&scope=openid
&username={EmpowerID person identifier}

Header Parameter	Required/Optional	Description

Header Parameter	Required/Optional	Description
`Content-Type`	required	Must be `application/x-www-form-urlencoded`.

Post Body Parameter	Required/Optional	Description

Post Body Parameter	Required/Optional	Description
`client_id`	required	Must be the EmpowerID OAuth application client identifier.
`client_secret`	required	Must be the EmpowerID OAuth application client secret.
`grant_type`	required	Must be `client_credentials`
`scope`	optional	A space-separated list of strings that the user consents to. Values include `openid` for OpenID Connect flow.
`username`	optional	Determines the identity for whom the access token should be issued. If this value is null or not present, the access token will be issued to the owner of the registered OAuth application.

3. Returns access token (optionally ID token) in the response

{
    "access_token": "xxxxxxxxxxxxxxxxxxxxxx",
    "token_type": "Bearer",
    "expires_in": 3600,
    "id_token": "xxxxxxxxxxxxxxxxxxxxxx",
    "id": "xxxxxxxxxxxxxxxxxxxxxx"
}

IN THIS ARTICLE