Client Credentials Flow: Obtain Access Token
Authenticate client applications using Client Credentials flow and get access tokens for Connect API access.
Raidiam recommends reading the Obtaining Access Tokens article first to learn about used specifications, all available access scopes and what they enable, and more.
- Active Transport Certificate If not yet added, request Transport Certificate for an organisation or an application.
- Active Signing Certificate along with a Public and Private Keys if your application uses the private_key_jwt client authentication method. If not yet added, request Signing Certificate for your organisation or application.
Add Raidiam's Authorisation Server /.well-known endpoint to your OAuth library configuration.
Your OAuth library should be able to get the server's configuration.
Sample /.well-known: https://auth.sandbox.raidiam.io/.well-known/openid-configuration
The /.well-known endpoint contains all the information about the Authorisation Server you need to successfully integrate with the server and get access tokens, for example the OAuth Token Endpoint: "token_endpoint": "https://auth.sandbox.raidiam.io/token" or mTLS Endpoint Aliases - for clients authenticating themselves using the tls_client_auth method:
Download Transport Certificate for your organisation or application and add it to your OAuth library client's configuration.
The Transport Certificate will be used in mutual Transport Layer Security (mTLS) to establish a secure connection between your client and the authorisation server.
Your OAuth client library should be capable of verifying the authorisation server's certificate.
If you are using cURLs to test the integration, you can disable checking the server's certificate using the -k flag or --insecure option.
Call the Raidiam's OAuth /token endpoint to authenticate your client.
Utilize the client authentication method configured for your client:
- tls_client_auth -- Mutual-TLS Client Authentication and Certificate-Bound Access Tokens RFC8705 If your using the tls_client_auth method, remember to use the mTLS endpoint aliases instead of the regular OAuth token endpoint.
Upon successful validation of the request, the authorisation server issues and returns an access token - in a form of a JWT signed using the algorithm configured for your client (Applications > your application > Advanced Configuration > Token Signed Response Algorithm ID)