Authentication
Authenticate an API service account with OAuth 2.0 client credentials.
Eseye APIs use the OAuth 2.0 client credentials grant. This flow authenticates an API service account rather than an individual Infinity user.
It is designed for server-to-server integrations that can store credentials securely.
How authentication works
Your application sends its client ID and client secret to the Request access token.
Eseye verifies the service account and returns an access token.
Your application sends the access token with each API request.
When the token expires, your application requests a new one.
Service accounts
An API service account identifies an integration and controls what that integration can do.
Eseye provisions the service account and provides:
A client ID
A client secret
The AWS region used for authentication
Access to the agreed APIs and operations
The client ID identifies the service account. The client secret proves that your application is authorised to use it.
Access tokens
A successful authentication request returns an OAuth 2.0 bearer token. Include it in the Request headers of every protected API request:
Access tokens expire after one hour. The client credentials flow does not require a user to sign in again. Request another token using the same service account credentials when the current token expires.
Your application should reuse a valid token instead of requesting a new token before every API call.
Token endpoint
Request tokens from the production endpoint for your AWS region:
For example:
See Request access token for the complete request.
Request an access token
The token service uses a regional endpoint. For example:
The Request access token includes the headers, form parameters, response, and request example.
Protect your credentials and tokens
Store the client secret in an environment variable or secrets manager.
Request tokens only from a trusted server-side application.
Do not expose credentials in browser or mobile application code.
Do not commit credentials or tokens to source control.
Do not write credentials or complete access tokens to application logs.
Always send credentials and tokens over HTTPS.
Base64 encoding does not encrypt the client ID and client secret. HTTPS protects the credentials while they are being transmitted.
Permissions
An access token can only authorise operations allowed by its service account.
If an API returns Error handling, the token may be valid but the service account does not have permission to perform that operation. Contact Eseye to request the required access.
Last updated
Was this helpful?