DEV - Authentication | DOCS - SweetConnect Platform

Standards

SweetConnect provides a standards-based identity and authorization service. Authentication and token-based access are based on established OAuth 2.0 and OpenID Connect standards.

Clients can use standard OAuth 2.0 and OpenID Connect libraries to interact with the identity service. Access tokens are sent to protected API endpoints using the OAuth 2.0 Bearer authentication scheme.

OAuth 2.1 is still under development. Any related capabilities enforced for a client depend on its SweetConnect configuration.

OpenID Connect Discovery

SweetConnect publishes its OpenID Connect configuration through a standard discovery endpoint.

Issuer

https://iam.dev.sweetconnect.io/realms/sweetconnect-dev

Discovery endpoint

https://iam.dev.sweetconnect.io/realms/sweetconnect-dev/.well-known/openid-configuration

The discovery document provides the currently available endpoints and supported protocol capabilities. OAuth and OpenID Connect clients should use this metadata instead of relying on manually constructed endpoint URLs.

Common Integration Endpoints

The following selection covers endpoints commonly used by API clients and integrations. The discovery document provides the complete list of currently available endpoints.

Endpoint	URL	Purpose
Token	`https://iam.dev.sweetconnect.io/realms/sweetconnect-dev/protocol/openid-connect/token`	Obtain an access token or renew it using a refresh token
Logout	`https://iam.dev.sweetconnect.io/realms/sweetconnect-dev/protocol/openid-connect/logout`	End an OpenID Connect session
JWKS	`https://iam.dev.sweetconnect.io/realms/sweetconnect-dev/protocol/openid-connect/certs`	Public keys for validating signed tokens
Introspection	`https://iam.dev.sweetconnect.io/realms/sweetconnect-dev/protocol/openid-connect/token/introspect`	Check token status and metadata
Revocation	`https://iam.dev.sweetconnect.io/realms/sweetconnect-dev/protocol/openid-connect/revoke`	Revoke access or refresh tokens

Authentication Capabilities

SweetConnect clients are configured according to their integration type. Not every authentication capability is enabled for every client.

Capability	Typical use
Client Credentials Flow	Service-to-service integrations without user interaction
Authorization Code Flow with PKCE	Applications acting on behalf of a signed-in user
Password Grant (Direct Access)	Integrations accessing the API on behalf of a user account
Refresh Tokens	Renewing access tokens without repeating user authentication
Device Authorization Grant	Authentication on devices with limited input capabilities
Token Exchange	Exchanging an existing token for a token intended for another context

The password grant is available for API integrations acting on behalf of a user account. The client credentials flow is used for platform integrations without user interaction. Client credentials, scopes, roles, and enabled capabilities are provided as part of the SweetConnect integration setup.

Authenticating API Requests

Protected SweetConnect API endpoints require an OAuth 2.0 access token. Send the token as a Bearer token in the Authorization header of every request.

The following examples obtain an access token. Use the flow that matches your integration.

Password Grant

Used by API integrations acting on behalf of a user account.

curl --request POST \
  --url https://iam.dev.sweetconnect.io/realms/sweetconnect-dev/protocol/openid-connect/token \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'grant_type=password' \
  --data-urlencode 'client_id=<client_id>' \
  --data-urlencode 'username=<username>' \
  --data-urlencode 'password=<password>' \
  --data-urlencode 'scope=openid'

A successful response contains the access token and a refresh token:

{
  "access_token": "<access_token>",
  "token_type": "Bearer",
  "expires_in": 300,
  "refresh_token": "<refresh_token>"
}

Client Credentials

Used by platform integrations without user interaction.

curl --request POST \
  --url https://iam.dev.sweetconnect.io/realms/sweetconnect-dev/protocol/openid-connect/token \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'grant_type=client_credentials' \
  --data-urlencode 'client_id=<client_id>' \
  --data-urlencode 'client_secret=<client_secret>'

A successful response contains the access token:

{
  "access_token": "<access_token>",
  "token_type": "Bearer"
}

Keep client credentials secure

Client secrets must only be used in trusted server-side environments and must never be exposed in browser or mobile application code.

Using the Access Token

Use the value of access_token when calling a protected API endpoint:

curl --request GET \
  --url <api-endpoint> \
  --header 'Authorization: Bearer <access_token>'

This example represents a typical service-to-service integration. Client credentials, scopes, and enabled capabilities are provided as part of the SweetConnect integration setup.

Authentication

On this page