Obtaining Tokens: Cheatsheet
| Grant Type | When | Other Specifications | Client Authentication Method | Scopes |
|---|---|---|---|---|
| Authorization Code Flow | When performing web-based operations related to administrative tasks | - Proof Key for Code Exchange RFC7636
- OAuth 2.0 Pushed Authorization Requests (PAR) RFC9126
If Message Signing is required: - JWT-Secured Authorization Request (JAR) RFC9101 and connected: - JSON Web Token RFC7519 - JSON Web Signature (JWS) RFC7515 - JSON Web Encryption (JWE) RFC7516 | - tls_client_auth -- Mutual-TLS Client Authentication and Certificate-Bound Access Tokens RFC8705
- private_key_jwt -- Assertion Framework for OAuth 2.0 Client Authentication RFC7521 | directory:website openid email profile |
| Client Credentials Flow | Managing an application, performing READ operations for all resources available within the platform, pulling a list of all registered clients, getting a list of all available authorisation servers to scan for Data Providers, obtaining information about the APIs published within the ecosystem or federation, and more | n/a | - tls_client_auth -- Mutual-TLS Client Authentication and Certificate-Bound Access Tokens RFC8705
- private_key_jwt -- Assertion Framework for OAuth 2.0 Client Authentication RFC7521 | directory:software |
| Client Credentials Flow | Privileged administrative operations beyond what directory:website/directory:software cover, for example managing Super Users and Data Administrators, registering Certificate Authorities, and managing OAuth clients directly. Access is restricted. | n/a | - tls_client_auth - private_key_jwt | directory:admin |
| Client Credentials Flow | Service-desk read-only access to organisation contacts, admin users, and authorisation domain users, plus related reference data. | n/a | - tls_client_auth - private_key_jwt | directory:servicedesk |
| Client Credentials Flow | Certificate operations for your own software statement, a narrower alternative to directory:software. | n/a | - tls_client_auth - private_key_jwt | directory:software:cert:management |
| Client Credentials Flow | Certificate operations across your entire organisation, not just your own software statement. | n/a | - tls_client_auth - private_key_jwt | directory:software:organisation:cert:management |
| Client Credentials Flow | Managing software statements across your entire organisation, not just your own. | n/a | - tls_client_auth - private_key_jwt | directory:software:organisation:application:management |
| Client Credentials Flow | Creating and updating authorisation domain users for an organisation. | n/a | - tls_client_auth - private_key_jwt | directory:software:user:management |
| Client Credentials Flow | Read-only access to the Audit API, without needing a Super User, Data Administrator, or Organisation Admin login. | n/a | - tls_client_auth - private_key_jwt | directory:software:audit |