Skip to content

OAuth integration

At customer's preference, it is possible to integrate with AutoGrab APIs via OAuth client credential token grant.

OAuth integration consists of 2 basic components:

  1. Token management (ensure your system always has a valid OAuth token available)
  2. REST api call signing using a valid token

Token management

Before implementing token management, make sure you have a valid client_id and client_secret as provided by AutoGrab. (They will be provided by your sales rep.) These are the credentials you will use to get valid tokens from the AutoGrab auth-broker.

auth-broker POST call to receive a valid OAuth token


Post body
{ grant_type: client_credentials }
Content-Type: application/x-www-form-urlencoded
Basic Auth of form client_id:client_secret Base64 encoded

Sample success response body
    "access_token": "[obfuscated-token-string]",
    "expires_in": 3599,
    "scope": "",
    "token_type": "bearer"

A valid token can be stored locally for use in subsequent api calls. It is recommended to calculate a safe expiry timestamp based on the expires_in property of the response body, and use this to pre-emptively refresh your token when it nears expiry.

REST api call signing

With a valid AutoGrab OAuth token to hand, each REST api call that you make can be authorised by encoding the as-provided token string into your Authorization header using Bearer prefix.


Token management

  • I don’t get a 200 response on my request-token calls Double-check your client_id and client_secret with AutoGrab. Double-check your Basic Auth encoding. Double check your content-type header and post body structure.

  • I have a valid token but my autograb api calls are failing 401 response -- there may be a problem with your token, or the way Bearer Auth is being encoded in the headers.