Skip to main content
This page is for Authlete 2.x. For current (3.0) documentation, see Getting Started.
Try the OAuth 2.0 authorization flow using Authlete.

​
1. Create your account

Fill in the registration page and click Sign Up.
Authlete sign-up page with the registration form

​
2. Check your inbox

You will get an email from Authlete, describing instructions on how to try the OAuth 2.0 flow.
Sign-up confirmation email from Authlete containing the instructions
You can try the OAuth 2.0 flow right after the signup. The following settings have been configured:
  • An Authlete service instance
  • A default OAuth 2.0 authorization endpoint
  • Sample client application settings

​
3. Click the Authorization Endpoint button

You will be navigated to a login page for authentication and authorization.
Login page shown after following the Authorization Endpoint link from the email
The Authorization Endpoint button in the email invokes an authorization request (implicit grant flow) from your web browser to Authlete’s default authorization endpoint. The actual URL of the request is:https://api.authlete.com/api/auth/authorization/direct/<SERVICE_API_KEY>?response_type=token&client_id=<SAMPLE_APP_CLIENT_ID>

​
4. Enter login information

Use the API key and secret of your Authlete service instance.
Login form asking for the service API key and API secret
You can see the API key and secret by logging in to Service Owner Console.
  1. Click the button in the email.
    Email button that opens Service Owner Console
  2. Check the API key and secret.
    Service Owner Console showing the service API key and API secret
For testing purposes, the default authorization endpoint authenticates a user with the API key and secret.

​
5. Click the Authorize button

Your browser will be redirected to the client’s redirection endpoint that shows an issued access token. You can find the same access token in the fragment part of the destination URL. https://api.authlete.com/api/mock/redirection/<SERVICE_API_KEY>#access_token=SNqzo...&token_type=Bearer&expires_in=86400&scope=
Redirection endpoint page displaying the issued access token
Congratulations! You successfully issued your first access token using Authlete.

​
What to do next

​
Try the authorization code grant flow

Try the authorization code grant flow in addition to the implicit grant flow in the previous section.
  1. Enter the following URL (authorization request) to your web browser and submit it. https://api.authlete.com/api/auth/authorization/direct/<SERVICE_API_KEY>?response_type=code&client_id=<SAMPLE_APP_CLIENT_ID> This request is the same as the previous one except response_type=code. Replace <SERVICE_API_KEY> / <SAMPLE_APP_CLIENT_ID> with the appropriate values in your environment.
  2. You will be navigated to the login page. Enter the API key and the secret.
    Login page for the authorization code grant flow
  3. Your browser will be redirected to the client’s redirection endpoint. Enter the value of SAMPLE_APP_CLIENT_ID in the client_id field and click Submit to make a token request.
    Redirection endpoint form with a client_id field and a Submit button
  4. The token response (JSON formatted) will be displayed. There should be values for "access_token" and "refresh_token".
    Token response JSON containing access_token and refresh_token

​
Authorization server implementations

In the previous section, you tried the flow using the default implementation of the authorization endpoint. For real deployments, you have freedom of choice to implement your own authorization server using Authlete Web APIs. java-oauth-server is an open-source authorization server written using Authlete Web APIs. It is the reference implementation in Java and a good starting point for your own authorization server implementation.
java-oauth-server repository on GitHub
This reference implementation uses Authlete as its backend so that it can eliminate efforts to set up a database server as storage of authorization data (e.g. access tokens), configuration data of the authorization server itself as well as client application settings communicating with the server. So you can download and start the authorization server only with a few commands as shown below:
Please check the documents at java-oauth-server for details.
If you implement your own authorization server using Authlete Web APIs, you don’t have to implement an authentication callback endpoint, but instead you are required to customize some source files related to end-user authentication.