Authorization Grant
The authorization code grant type is the most common flow and is used to obtain both access tokens and refresh tokens. If you've approved a Facebook application you're probably familiar with it. Read more about the Authorization Code Grant.
Summary of steps:
- User clicks a link on your site (for example "Connect to LionDesk") to initiate the authorization flow.
- User is taken to an "OAuth Dialog" and asked to approve your application
- After approving your application the page redirects to the Redirect URI of your application and includes the authorization code in the query string, ie. "?code=b2374c372054e43c8da7c5ed681d8de880ee9762"
- You exchange the authorization code for an access token
1. Display an Authorization Link
Create a link to https://api-v2.liondesk.com//oauth2/authorize with the following query parameters:
Parameter | Value | Description |
---|---|---|
response_type | code | |
client_id | [your Client ID] | |
redirect_uri | [your Redirect URI] | |
scope | [requested scopes] | space-delimited string. eg. "write" |
Example:<a href="https://api-v2.liondesk.com//oauth2/authorize?response_type=code&client_id=liondesk&scope=write&redirect_uri=https://myapp.co/liondesk/callback">Connect with LionDesk</a>
Your users can click this link to start the authorization flow.
2. Receive the Authorization Code
If the user approves your request they will be redirected to your Redirect URI with an authorization code in the query string.
Example:https://myapp.co/liondesk/callback?code=b2374c372054e43c8da7c5ed681d8de880ee9762
Your server should then:
- Extract the value for code. e.g.
b2374c372054e43c8da7c5ed681d8de880ee9762
- Create a server-to-server request to exchange the code for an access token (see next step)
3. Exchange the Authorization Code
Include the authorization code and your application details in the POST body. Example:
POST https://api-v2.liondesk.com//oauth2/token
headers: {
Content-Type: "application/json"
}
body: {
code: "b2374c372054e43c8da7c5ed681d8de880ee9762",
client_id: "liondesk",
client_secret: "16bd4b72a6d8ce845b834ca12b559c467cecac77",
redirect_uri: "https://myapp.co/liondesk/callback",
grant_type: "authorization_code"
}
The server will respond with an access token and some meta data:
{
"access_token": "33a89a91eeb6eaa2e2f42836c4e2302d8eb3f9ee",
"refresh_token": "f98fce91346ac686f9be5ec5e42b04ce26ed2c1f",
"expires": "2018-04-12T08:33:37.000Z",
"expires_in": 7776000,
"scope": "write",
"token_type": "Bearer"
}
4. Use the Token!
Congrats you now have an access token to use to make requests on behalf of the user.