Implement secure OAuth 2.0 authentication to access Ademero APIs. Follow our comprehensive guide to integrate authorization flows, manage tokens, and build secure applications.
Follow these steps to implement the OAuth 2.0 authorization code flow
GET https://api.ademero.com/oauth/authorize?
client_id=YOUR_CLIENT_ID&
redirect_uri=YOUR_REDIRECT_URI&
response_type=code&
scope=read write&
state=RANDOM_STATE// User sees authorization screen
// Approves or denies access
// Redirected back to your appPOST https://api.ademero.com/oauth/token
Content-Type: application/x-www-form-urlencoded
grant_type=authorization_code&
code=AUTHORIZATION_CODE&
client_id=YOUR_CLIENT_ID&
client_secret=YOUR_CLIENT_SECRET&
redirect_uri=YOUR_REDIRECT_URIGET https://api.ademero.com/documents
Authorization: Bearer YOUR_ACCESS_TOKEN
// Response includes user documentsRequest specific permissions based on your application needs
Get started quickly with our official OAuth SDKs
// Install SDK
npm install @ademero/oauth-sdk
// Initialize OAuth client
import { AdemeroOAuth } from '@ademero/oauth-sdk';
const oauth = new AdemeroOAuth({
clientId: process.env.ADEMERO_CLIENT_ID,
clientSecret: process.env.ADEMERO_CLIENT_SECRET,
redirectUri: 'https://your-app.com/callback'
});
// Generate authorization URL
const authUrl = oauth.getAuthorizationUrl({
scope: ['read', 'write'],
state: generateRandomState()
});
// Exchange code for token
const tokens = await oauth.exchangeCode(authorizationCode);Follow these security best practices for OAuth implementation
Master advanced OAuth 2.0 concepts and implementation patterns
Implement secure refresh token rotation to minimize the impact of token compromise. When users refresh their access tokens, the server issues a new refresh token and invalidates the previous one, preventing token reuse attacks.
Monitor refresh token rotation patterns to detect suspicious activity. If an old refresh token is used multiple times, it may indicate a compromised token. Always validate the integrity of tokens before accepting them.
Best for long-lived sessions with high security requirements
Proof Key for Code Exchange (PKCE) is critical for public clients like mobile apps and single-page applications that cannot securely store a client secret. Generate a random code verifier and create a code challenge hash to prevent authorization code interception attacks.
The attacker who intercepts an authorization code cannot exchange it without the original code verifier, making token theft significantly more difficult even if the code is compromised.
Essential for mobile apps, SPAs, and native applications
Use the token introspection endpoint to validate token status at runtime. Query whether a token is still active, check expiration times, and verify scope validity. This is useful for shared resources that need to validate tokens from multiple clients.
Implement caching with appropriate TTLs to reduce latency while maintaining security. Always handle introspection failures gracefully and treat inactive tokens as unauthorized requests.
Use for real-time token validation in resource servers
Implement immediate token revocation when users log out or change their password. The token revocation endpoint allows clients to request token invalidation, preventing further use even before natural expiration.
Maintain a revocation list or token blacklist on the server side. For high-security applications, consider synchronous validation across distributed systems to ensure revoked tokens are immediately rejected.
Critical for security-sensitive operations and account changes
Common OAuth errors and how to handle them
| Error Code | Description |
|---|---|
invalid_request | The request is missing a required parameter or includes an invalid parameter value |
unauthorized_client | The client is not authorized to request an authorization code |
access_denied | The resource owner denied the request |
unsupported_response_type | The authorization server does not support the response type |
invalid_scope | The requested scope is invalid, unknown, or malformed |
server_error | The authorization server encountered an unexpected condition |
Get your API credentials and start integrating Ademero into your application today.