Authorizing server-to-server API calls?

Louise Seale

What's the best way to set up an OAuth 2.0 authorized request to the API from an automated script?

I'm trying to set up an API solution that will submit a specific expense type automatically, pulling from another resource used by our organization; however, the instructions I can find in the documentation all seem to pertain to user-facing apps.

What would be best for a case where the user won't interact with the application? What should the authentication workflow look like for cases where there won't be someone to perform the authorize/redirect step?

Ben Regier

@Louise Seale
You'll want to use the confidential applications flow. This will require user interaction to return your first token, but once you have that token you can save it and use the refresh token to automatically refresh your token programmatically whenever you want.

Louise Seale

@Ben Regier

I'm a bit new to working with OAuth2.0, so please clarify for me: will the refresh token expire at any point/will the manual token generation step need to be repeated at any point?

Alex Wong

@Louise Seale
Authentication token is good for 60 minutes

Refresh token is good for 365 days. You can use refresh token to get new authentication token as long as the refresh token isn't expired. When getting a new authentication token, you have option to “refresh” the refresh token too, which keeps the refresh token “rolling” so it won't expire and needing to do the “manual login".

Ben Regier

@Louise Seale
As Alex said, the refresh token does expire, but it has a much longer life than the access token

Every time you refresh your access token, you can also get a new refresh token. So my process just saves both of them for next time and I never have to worry about the refresh token expiring.

If everything goes well, you should only need to do the manual process once, to get your first set of tokens. But you may as well keep that script around in case you need to do it again sometime in the future!

Louise Seale

@Alex Wong @Ben Regier

This helps immensely. Thank y'all both very much!