Authorisation

Ophelos supports OAuth 2.0 for authorizing API requests.

The OAuth framework provides several grant types for different use cases. In the Machine To Machine communication, we use the Client Credentials Grant Type

In summary, authorized requests to the API should use an Authorization header with the value Bearer <TOKEN>, where <TOKEN> is an access token obtained through the OAuth flow.

Shell

curl https://api.ophelos.com/debts \
  -H "Authorization: Bearer <TOKEN>"

The access token is a string that contains the credentials and permissions needed for an application to access protected resources.

Request an access token

First obtain your Client ID, Client Secret and Audience by contacting our development team.

Once you have the client credentials, you can request an access token through our token endpoint URI.

Shell

curl --request POST \
  --url 'https://id.ophelos.com/oauth/token' \
  --data grant_type=client_credentials \
  --data client_id={YOUR_CLIENT_ID} \
  --data client_secret={YOUR_CLIENT_SECRET} \
  --data audience={YOUR_API_IDENTIFIER}
  --date scope={API_PERMISSION_IF_EXISTS}

Parameters

Parameter Name	Relevance	Description
grant_type	Required	Set this to "client_credentials"
client_id	Required	Your application's Client ID
client_secret	Required	Your application's Client Secret
audience	Required	Your application's Identifier
scope	Optional	The scopes which you want to request authorization for

Response

JSON

{
  "access_token": "eyJz93a...k4laUWw",
  "token_type": "Bearer",
  "expires_in": 3600
}