🔑Authentication

Version: 1.0.0

Description: Learn how to obtain an authentication token from `https://auth.revtek.cloud` for secure API access with scopes.

Obtaining an Access Token with Scopes

To access the API securely with fine-grained access control, you can request an access token with specific scopes. Follow the steps below:

Step 1: Authorization

Start by obtaining authorization from the OAuth2 authorization server while specifying the required scopes in your request:

    
POST /authorize
Host: auth.revtek.cloud
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials
client_id=your_client_id
client_secret=your_client_secret
scope=device:read device:write user:read
    
  

The server will respond with an access token, its expiration time, and the granted scopes:

    
HTTP/1.1 200 OK
Content-Type: application/json

{
  "access_token": "your_access_token",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "device:read device:write user:read"
}
    
  

Step 2: Using the Access Token with Scopes

With the obtained access token and associated scopes, you can make authorized requests to the API. Include the access token in the `Authorization` header of your requests:

    
GET /api/device
Host: api.example.com
Authorization: Bearer your_access_token
    
  

The API server will verify the token and check if it has the necessary scope to perform the requested action.

Refreshing the Token with Scopes

Access tokens with specific scopes have a limited lifespan. To continue using the API with the same scope, you may need to refresh the token using the refresh token:

    
POST /token
Host: auth.revtek.cloud
Content-Type: application/x-www-form-urlencoded

grant_type=refresh_token
refresh_token=your_refresh_token
client_id=your_client_id
client_secret=your_client_secret
scope=device:read device:write user:read
    
  

The server will respond with a new access token, its expiration time, and the same scopes.

Revoking Access

If you need to revoke access, contact the authorization server with the token to be revoked:

    
POST /revoke
Host: auth.revtek.cloud
Content-Type: application/x-www-form-urlencoded

token=your_access_token
    
  

The authorization server will invalidate the token, preventing further access.

By following these steps, you can securely access the API with specified scopes using OAuth2 authentication provided by `auth.revtek.cloud`.