Authorizing server-to-server API calls?

Louise Seale
Louise Seale
Third Anniversary Name Dropper Facilitator 1 June 2023 Monthly Challenge
in SKY Developer General Discussions

What's the best way to set up an OAuth 2.0 authorized request to the API from an automated script?

I'm trying to set up an API solution that will submit a specific expense type automatically, pulling from another resource used by our organization; however, the instructions I can find in the documentation all seem to pertain to user-facing apps.

What would be best for a case where the user won't interact with the application? What should the authentication workflow look like for cases where there won't be someone to perform the authorize/redirect step?

Comments

  • Ben Regier
    Ben Regier
    Sixth Anniversary Kudos 5 Name Dropper Participant

    @Louise Seale
    You'll want to use the confidential applications flow. This will require user interaction to return your first token, but once you have that token you can save it and use the refresh token to automatically refresh your token programmatically whenever you want.

  • Louise Seale
    Louise Seale
    Third Anniversary Name Dropper Facilitator 1 June 2023 Monthly Challenge

    @Ben Regier

    I'm a bit new to working with OAuth2.0, so please clarify for me: will the refresh token expire at any point/will the manual token generation step need to be repeated at any point?

  • Alex Wong
    Alex Wong Community All-Star
    Tenth Anniversary Kudos 5 Facilitator 4 bbcon 2025 Attendee Badge

    @Louise Seale
    Authentication token is good for 60 minutes

    Refresh token is good for 365 days. You can use refresh token to get new authentication token as long as the refresh token isn't expired. When getting a new authentication token, you have option to “refresh” the refresh token too, which keeps the refresh token “rolling” so it won't expire and needing to do the “manual login".

  • Ben Regier
    Ben Regier
    Sixth Anniversary Kudos 5 Name Dropper Participant

    @Louise Seale
    As Alex said, the refresh token does expire, but it has a much longer life than the access token

    Every time you refresh your access token, you can also get a new refresh token. So my process just saves both of them for next time and I never have to worry about the refresh token expiring.

    If everything goes well, you should only need to do the manual process once, to get your first set of tokens. But you may as well keep that script around in case you need to do it again sometime in the future!

  • Louise Seale
    Louise Seale
    Third Anniversary Name Dropper Facilitator 1 June 2023 Monthly Challenge

    @Alex Wong @Ben Regier

    This helps immensely. Thank y'all both very much!

Categories