Scribd
Upload
5 views5 pages

Insights API - Machine-To-Machine (M2M) Authentication & Aut

The Insights API supports two authentication flows: a browser-based flow for UI users and a machine-to-machine (M2M) flow using Auth0 Client Credentials. This document details the implementation of M2M authentication, request validation, context population, and how to call the API from another system. It also includes instructions for configuring Auth0 and generating access tokens for API calls.

Uploaded by

chinnu1991.reddy1991
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
5 views5 pages

Insights API - Machine-To-Machine (M2M) Authentication & Aut

The Insights API supports two authentication flows: a browser-based flow for UI users and a machine-to-machine (M2M) flow using Auth0 Client Credentials. This document details the implementation of M2M authentication, request validation, context population, and how to call the API from another system. It also includes instructions for configuring Auth0 and generating access tokens for API calls.

Uploaded by

chinnu1991.reddy1991
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd

Insights API — Machine-to-Machine (M2M) Authentication &

Authorization

Overview
The Insights API supports two authentication flows:

Flow Use case Auth mechanism


Auth0 Authorization Code +
User flow Browser / UI users
Cookies
M2M System-to-system Auth0 Client Credentials (Bearer
flow calls token)

This document explains:

 How M2M authentication is implemented


 How requests are validated.
 How the request context is populated
 How to call the API from another system

┌────────────┐

│ Calling App│

│ (M2M) │

└─────┬──────┘

│ 1. Client Credentials

│ grant → access_token

▼
┌────────────┐

│ Auth0 │

│ │

└─────┬──────┘

│ 2. Bearer token

│ Authorization header

┌─────────────────────────┐

│ Insights API │

│ │

│ - JwtBearer auth │

│ - Validate issuer/aud │

│ - Identify M2M client │

│ - Populate context │

└─────────────────────────┘

Auth0 Configuration
Machine-to-Machine Application
Check the existing consumer application (security-jwt-api (Resilience))
Machine to Machine in Auth0.

Save below for security-jwt-api (Resilience)


client_id
client_secret
4.2 API Registration

Create an API (insights-public-api) in Auth0

Setting Value
Name Insights API
https://
Identifier
[Link]
Signing
RS256
Algorithm

Authorize below machine-to-machine application

Now Go to Applications and check API tab for security-jwt-api (Resilience) (M2M
consumer service) that insights-public-api is authorized or not.
How to Generate and make call

Token Request (Client Credentials) from Resilience

curl -X POST [Link] \


-H "content-type: application/json" \
-d '{
"client_id": "<CLIENT_ID>",
“client_secret": "<CLIENT_SECRET>",
"audience": "[Link]
"grant_type": "client_credentials
}'

Expected JWT Claim


{
“iss": "[Link]
"aud": "[Link]
"gty": "client-credentials",
"azp": "<client_id>",
"exp": 1767177246
}

Calling Riskonnect users create endpoints from resilience.

curl -X 'POST' \ '[Link] \ -H 'accept: */*' \ -H 'Authorization: Bearer <<token>>' \ -H


'Content-Type: application/json' \ -d '{ "customerId": 0, "name": "sgiri009", "email": "sgiri009@[Link]", "role":
"Viewer" }'

You might also like