Account OAuth Flow
Aurinko provides multiple Unified OAuth Flows backed by providers’ OAuth2 (i.e. Google, Office 365, Zoho Mail, Salesforce, HubSpot, SugarCRM) or by secure password-based authentication (i.e. MS Exchange, IMAP accounts).
Account OAuth Flow
User delegated authorization that produces an Aurinko account and an access token.
This is a standard flow for getting access to a remote account. To enable Google and Office 365 OAuth flow for production, please see the following instructions Office365 OAuth Setup and Google OAuth Setup.
This flow uses user-delegated authorization and produces an Aurinko account and an access token.
From your application, redirect users to https://api.aurinko.io/v1/auth/authorize
, with the query parameters detailed in /auth/authorize. You'll need to set the responseType=code
.
Note:
responseType=token
for client-side flows (corresponding to the OAuth's implicit grant) is supported but is not recommended!
You'll also need to determine what permissions your application will request from users, and update the scopes
query parameter accordingly. Aurinko provides granular authentication scopes that empower users with control over what level of access your application has to their data. See supported Authentication scopes for details.
Here's an example of what this URL might look like once you've included all the correct query parameters:
Redirect URI: Redirect page vs. Custom domain alias
Google app registrations allow only authorized redirect URIs under a domain you own so the default Aurinko's Redirect URI https://api.aurinko.io/v1/auth/callback
won't work for you in production.
You have two options:
Contact us about provisioning a domain alias for your Aurinko app so you can use a url like
https://aurinko.mydomain/v1/auth/callback
Create your intermediate redirect page to use for redirecting all calls to Aurinko's
https://api.aurinko.io/v1/auth/callback
with the URL parametersstate
,code
, andscope
. See the corresponding OAuth flow in the following diagram:
User Consent
Aurinko will present your user with the correct sign-in form based on the requested service type (Google, Office365, EWS). For Exchange users, the user has to enter a login name and an Exchange server URL.
Getting the token
Once the user has signed in and authorized your app's access, their browser will be redirected to the returnUrl
you provided.
Implicit Grant (
responseType=token
)If the authentication is successful Aurinko will include the hash fragment
#accessToken={accessToken}
with the account access token. That's it!Example redirect URL:
https://your-app.com/callback?#accessToken={token}&state={state}&status=success
We recommend storing the
accessToken
and then removing it from the hash fragment with JavaScript. This is the token you will provide as anHTTP Bearer Auth
to make API calls on behalf of the user.Authorization Code Grant (
responseType=code
)If the authentication is successful Aurinko will include the
code
parameter in the query string.Example redirect URL:
https://your-app.com/callback?code={code}&state={state}&status=success
Make an HTTP POST call to
https://api.aurinko.io/v1/auth/token/{code}
to exchange thecode
for anaccess_token
.
Response:
See /auth/token for details. Make sure to securely store the accessToken
and provide it as the HTTP Bearer Auth
token to make API calls on behalf of the user (see Authentication details).
Last updated