Password Authentication

Password Authentication

OAuth Password Authentication, also known as the Resource Owner Password Credentials (ROPC) grant type, allows a client application to request an access token on behalf of a user by directly handling the user's credentials (username and password). This grant type is suitable for scenarios where the client is highly trusted, such as in first-party applications. However, it's important to note that this method should be used cautiously due to security considerations.

Here's an overview of how OAuth Password Authentication works:

Requesting an Access Token:

The client sends a token request to the token endpoint of the authorization server.

POST /token HTTP/1.1
Host: quote.calricosystems.com/token
Content-Type: application/x-www-form-urlencoded
grant_type=password
&username=user123
&password=pass456

   Parameters:
     'grant_type'='password': Indicates the use of the password grant type.
     'username' and 'password': User credentials.

Token Response:

   If the credentials are valid, the authorization server responds with an access token.

json
   {
     "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
     "token_type": "Bearer",
     "expires_in": 3600,
     "refresh_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
     "scope": "read write"
   }
The response includes the access token, token type, expiration time, refresh token, and scope.

Using the Access Token:

   The client includes the obtained access token in the Authorization header of subsequent API requests.

   http
   GET /api/resource HTTP/1.1
   Host: quote.claricosystems.com/token
   Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...
The resource server validates the access token and grants or denies access to the requested resource.

Security Considerations: 

SSL/TLS: Always use HTTPS to encrypt communication and protect the confidentiality of user credentials and tokens.

Client Trustworthiness: Only use OAuth Password Authentication in situations where the client application is highly trusted, such as in first-party applications.

User Consent: Ideally, users should be informed and consent to the client handling their credentials.

Token Lifetime: Be mindful of token lifetimes and consider implementing token refresh mechanisms.

Sensitive Data Handling: Protect user credentials and tokens from unauthorized access and exposure.



    • Related Articles

    • API Calls

      An API call is a request made by a computer program or application to communicate with an Application Programming Interface (API). APIs define a set of rules and protocols that enable different software applications to interact with each other. ...

    • Connection

      Introduction Connections play a crucial role in enabling communication between our platform and external web applications through plugins and web hooks. This documentation provides guidance on configuring authentication for different connection ...

    • Quote Integration Status

      Quote integration status allows for syncing between ClaricoQUOTE and ERP system. ClaricoQUOTE provides several quote status options giving users the ability to customize syncing to best suit their quoting process. See below for available status ...

    • ClaricoQUOTE API Guide

      ClaricoQUOTE API Guide The ClaricoQUOTE API allows for our quoting platform to communicate with other third-party systems like an ERP or CRM. Introduction The integration between ClaricoQUOTE and ERP or CRM systems varies from product to product, but ...

    • API Key Authentication

      OAuth typically doesn't use API keys in the traditional sense, as it relies on access tokens for authentication and authorization. However, API keys can still play a role in OAuth-based systems, particularly in scenarios involving public clients or ...