Client Credentials Grant
Deprecation Notice
There is a more recent version of this OpenId Connect API available. Learn more.
This endpoint will be removed from service on April 20th 2021.
The OpenId Connect Client Credentials grant can be used for machine to machine authentication. In this grant a specific user is not authorized but rather the credentials are verified and a generic access_token
is returned.
The access_token
is a signed JSON Web Token (JWT) which contains expiry information. It’s authenticity can be verified without the need for further API calls which makes it useful for authorizing other services where latency is a concern.
Note that the access token returned is different to the access token generated via the OAuth 2.0 Tokens API. Therefore it can not be used to authorize API calls against other endpoints such as Users or Events.
Resource URL
https://<region>.onelogin.com/oidc/token
Header Parameter
Authorization string |
Required if Token Endpoint Authentication Method is set to Basic Set to The e.g. Using Node.js this would be
|
Content-Type required string | application/x-www-form-urlencoded |
Resource Parameter
region required string |
Set to the
https://openid-connect-eu.onelogin.com/oidc
|
Request Parameter
grant_type required string |
Set to “client_credentials” |
client_id string |
The OneLogin generated Client ID for your OpenID Connect app. Required if Token Endpoint Authentication method is set to POST. |
client_secret string |
The OneLogin generated Client Secret for your OpenID Connect app. Required if Token Endpoint Authentication method is set to POST. |
Sample Request Body
grant_type=client_credentials
Sample Response
- 200 OK
- 400 Bad Request
- 401 Unauthorized
{
"access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IkpSY080bnhzNWpnYzhZZE43STJoTE80Vl9xbDFiZG9pTVhtY1lnSG00SHMifQ.eyJqdGkiOiJ1N2FTRDgyNFdrSnd0d3ZuZzZObWYiLCJpc3MiOiJodHRwczovL29wZW5pZC1jb25uZWN0Lm9uZWxvZ2luLmNvbS9vaWRjIiwiaWF0IjoxNTM0ODExODI2LCJleHAiOjE1MzQ4MTI0MjYsImF1ZCI6IjlhNmQ2MzUwLTJhZjgtMDEzNi0xOTdiLTA2YWNjNzZkMzRiNDkyOTIwIn0.VtybpMirTTrRGiYsJfX-yIjVkqkuyc1gj7pbim0ecOde3ku75Zvyh42nxkKdxxzBuMvWZpulpiaFru6ZAnd6MxZj9VyKmqZ3xFhBr0GRKzScRJjnX2_cAHCJtr7AqwxolaGsu4iZUolOrTdhX1BU3skLvNYE05TdeEITUsilEPL0ew5VV8MzYFQkY7Grr47MxpwEUv7yT6C3pz87Bgg5_7zFPHpLLeCRC8bhMK0rRe9uyK9ExQKIkLlf5Hyh1gfWqrTYwgXfIQt1Ba7IiAMAQvN60VTDbSxLBl0_x-vE-ezVfyHkN4d6owF37wOruoLsZ8c1braUNOWY00xkPwxxTQ",
"expires_in": 600,
"token_type": "Bearer"
}
The grant_type
MUST be set to client_credentials
{
"error": "unsupported_grant_type",
"error_description": "unsupported grant_type requested (xxxx)"
}
The authorization header is invalid
{
"error": "invalid_request",
"error_description": "invalid authorization header value format"
}
Invalid client_id
or client_secret
{
"error": "invalid_client",
"error_description": "client authentication failed"
}
Response Elements
access_token |
A JWT that represents the session that has just been created for the user. For example the body of the JWT contains:
|
expires_in |
The number of seconds until the session expires. |
token_type |
The type of access token. Always set to “Bearer” |
Sample Code
cURL
Replace sample values indicated by < >
with your actual values.
curl -XPOST "https://<region>.onelogin.com/oidc/token" \
-H "Authorization: Basic <base64 encoded client_id:client_secret>" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=client_credentials"
Postman Collection
Replace sample variables indicated by {{ }}
with your actual values.
Download for the OpenId Connect API
Have a Question?

Have a how-to question? Seeing a weird error? Ask us about it on StackOverflow.

Found a bug? Submit a support ticket.

Have a product idea or request? Share it with us in our Ideas Portal.
StackOverflow discussions about "[onelogin] openid connect"
-
A: SAML for Native Mobile Apps(Android and IOS)
Answered Apr 02 2018https://spin.atomicobject.com/2016/09/01/sharing-web-data-wkwebview/ Basically, if you do this, you'll also be supporting SSO on mobile via SAML (or OpenID Connect, if you go that route) …
-
Q: How to use onelogin SSO with AngularJS?
Asked Jun 20 2016After going through their documentation I have few questions: 1> Onelogin is using SAML instead of OpenID Connect. … I am not asking what's the difference between these two, but what is recommended since everyone is moving towards OpenID Connect? 2> Does Onelogin supports AngularJS? …
-
A: Does OneLogin support client session management via OIDC?
Answered Nov 16 2018https://openid.net/specs/openid-connect-session-1_0.html: 2.1. … I don't see these metadata parameters in the OneLogin discovery metadata, so it looks like Session Management is not supported. …
-
A: How to Validate an Access Token for OAuth2 + PCKE flow
Answered Apr 25 2019,"iss":"https://openid-connect.onelogin.com/oidc","jti":"..." … ,"scope":"openid profile email"} Both the access_token and refresh_token returned from the auth code flow https://developers.onelogin.com/openid-connect/api/authorization-code-grant worked, and the access_token …
-
Q: Python/Django library for registering multiple SSO Identity Providers(OpenID Connect)
Asked Nov 08 2019I'm working on a project written in Python(Django) and i recently added an SSO option for logging in with OneLogin accounts. There's already support for Microsofts Azure SSO from an earlier feature. … I'm looking for a library which can somehow register different identity providers(Microsoft, OneLogin, Facebook, etc...) and then wrap the similar login logic into a single class, which would handle all …

Loading...