OAuth 2.0

FoxIDs supports OAuth 2.0 application registrations for APIs and machine-to-machine clients. OAuth 2.0 is used for authorisation and access tokens; it is not configured as an authentication method for interactive user sign-in.

FoxIDs OAuth 2.0

Use an OpenID Connect application registration for interactive user sign-in and delegated access. OpenID Connect Authorization Code flow with PKCE provides the user authentication layer, while OAuth 2.0 access tokens protect APIs.

For machine-to-machine access, FoxIDs supports the OAuth 2.0 Client Credentials grant. A client can request an access token without a user and use it to call one or more configured resources.

Application registration

Configure an OAuth 2.0 application registration to define:

  • OAuth 2.0 clients and their authentication methods.
  • Resources representing protected APIs.
  • Scopes and claims included in access tokens.
  • Client Credentials access for service applications and background processes.
  • Token lifetime and certificate-based client authentication where required.

An OAuth 2.0 resource can also be defined on an OpenID Connect application registration when the same application provides interactive sign-in and protects an API.

User and service access

Use the flow that matches the caller:

  • For a user-facing application, configure OpenID Connect and request an access token for the required OAuth 2.0 resources.
  • For a service, daemon or background process, configure an OAuth 2.0 client using Client Credentials.
  • When a token issued for one trust context must be exchanged for another, review token exchange.