Authorization
Fundamentals on authorization in apps.
Last updated
Fundamentals on authorization in apps.
Last updated
Every request your application sends to the Xena API must include an authorization token. The token also identifies your application to Xena.
Every request your application sends to the Xena API must include an authorization token. The token also identifies your application to Xena.
Your application must use OAuth 2.0 to authorize requests. No other authorization protocols are supported.
All requests to the Xena API must be authorized by an authenticated user.
The details of the authorization process, or "flow," for OAuth 2.0 vary somewhat depending on what kind of application you're writing.
The following general process applies to all application types:
When you create your application, you register it in Xena developer and use the Xena Developer Console. Xena's Identity server then provides the information you'll need later, such as a client ID and a client secret.
When your application needs access to user data, it asks Xena's Identity server for a particular scope of access. (see: scopes below)
Xena's Identity server then displays a consent screen to the user, asking them to authorize your application to access some of their data.
If the user approves your request, then Xena's Identity server returns to your application a short-lived access token. Access tokens granted by Xena's Identity server are valid for one hour.
Your application requests user data, attaching the access token to the request. All your requests to the Xena API should submit an authorization header bearer token.
If Xena's API determines that your request and the token are valid, it returns the requested data.
Some flows include additional steps, such as using refresh tokens to acquire new access tokens. For detailed information about flows for various types of applications, see .
Here is a list of the OAuth 2.0 scopes for the Xena API:
Scope
Meaning
testapi
Full, permissive scope to access all of a user's Xena data.
profile
users profile information, name, culture, picture
users email
offline_access
returns a refresh token