Authorization Code Flow
The authorization code flow is best used for web application with a confidential client running on a server side.
Resource owners access the client via an HTML user interface rendered in a user-agent on the device used by the resource owner.
The client credentials as well as any access token issued to the client are stored on the web server and are not exposed to or accessible by the resource owner.
The client should be registered with Space as Server-side Web App or Mobile or Desktop App.
To start the authentication process, the client should redirect the user's browser to the authentication endpoint
<Space service URL>/oauth/auth in the following format:
To instruct Space to issue a refresh token, add the
access_type=offline parameter to your request:
To obtain an access token from Space, your client needs to provide values for the following parameters in authorization requests:
|Specifies the grant type in an OAuth 2.0 request. Set value to |
|An identifier for the current application state. For example, it can be a key for a local storage object that contains information about the location of the current user in the client application.|
|A URI in your client application that can handle responses from Space.|
A parameter that determines whether the user should be asked to log in. The following values are valid:
|The ID assigned to your client application when you register it in Space. To get the client ID, go toand choose your client from the list.|
|The private identifier assigned to your client application when you register it in Space. To get the client secret, go toand choose your client from the list.|
A space separated list of rights required to access specific resources in Space.
The rights are grouped in four categories: Global, Profile, Team, Project. Use the following syntax to specify the rights (shown here in BNF notation):
<SCOPE> ::= <ALL> | <TOKEN_LIST> <ALL> ::= '**' <TOKEN_LIST> ::= <TOKEN> (' ' <TOKEN>)* <TOKEN> ::= <GLOBAL_PERMISSIONS_TOKEN> | <ENTITY_PERMISSIONS_TOKEN> <GLOBAL_PERMISSIONS_TOKEN> ::= <PERMISSIONS> <ENTITY_PERMISSIONS_TOKEN> ::= <ENTITY> ':' <PERMISSIONS> <ENTITY> ::= 'Team' | 'Project' | 'Profile' | 'etc.' <PERMISSIONS> ::= <ALL_PERMISSIONS> | <PERMISSION_LIST> <ALL_PERMISSIONS> ::= '*' <PERMISSION_LIST> ::= <PERMISSION> (',' <PERMISSION>)*
Wildcards are accepted. For global rights, category is omitted.
AddNewProfile,AddNewTeam Team:EditTeam Profile:EditAbsences,EditLanguages Project:*
The rights you specify in
|Indicates whether the application requires access to Space when the user is not online. Allowed values: |
If the resource owner grants the access, Space issues an authorization code and delivers it to the client by adding the following parameters to the query component of the redirection URI using the
|code||The authorization code generated by Space. The authorization code will expire shortly after it is issued to mitigate the risk of leaks. The client must not use the authorization code more than once. If an authorization code is used more than once, Space will deny the request. The authorization code is bound to the client identifier and redirection URI.|
|state||The exact value received from the client in the authorization request.|
Example: Space redirects the browser by sending the following HTTP response:
The client must ignore unrecognized response parameters.
Handling error response
If the resource owner denies the access request or if the request fails for reasons other than a missing or invalid redirection URI, Space informs the client by adding the following parameters to the query component of the redirection URI using the
A single ASCII [USASCII] error code from the following:
invalid_request— The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed.
unauthorized_client— The client is not authorized to request an authorization code using this method.
access_denied— The resource owner or Space denied the request.
unsupported_response_type— Space does not support obtaining an authorization code using this method.
invalid_scope— The requested scope is invalid, unknown, or malformed.
- Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding what went wrong.
Exchanging authorization code for an access token
After the client receives the code it can exchange it for an access token.
The client makes a request to the Space token endpoint by sending the following parameters using the
application/x-www-form-urlencoded format with a character encoding of UTF-8 in the HTTP request entity-body:
Handling Access Token Response
If the access token request is valid and authorized, Space issues an access token. If the request has failed or is invalid, the Space server returns an error response.
Example of a successful response: