OAuth1

Grants

Password grant

The Password Grant accepts your username and password, then returns an Access Token and a Refresh token. As mentioned before the Access Token can be used to authenticate API requests.

See also the Password Policy User Service setting for more information about the password format and login attempts.

JavaScript

await exh.auth.authenticate({
    email:'[e-mail]',
    password:'myPassword1234'
});

Note that in case this user has MFA enabled this function will throw a MfaRequiredError. With the information in the error you can follow the MFA Grant to complete the authentication.

MFA Grant

When MFA is enabled for a user and you try to authenticate using the password grant you will receive a MfaRequiredError . You can catch the error and use the MFA Grant to complete the authentication.

JavaScript

try {
  await exh.auth.authenticate({
    password: '',
    email: '',
  });
} catch (error) {
  if (error instanceof MfaRequiredError) {
    const mfaToken = error.mfa.token;
    
    const mfaMethods = error.mfa.methods;
    // Your logic to request which method the user want to use in case of multiple methods
    const methodId = mfaMethods[0].id;

    await exh.auth.confirmMfa({
      token: mfaToken,
      methodId: methodId,
      code: '', // code from ie. Google Authenticator
    });
  }
  // handle other possible authentication errors
}

SSO Token Grant

You can exchange an SSO token generated by application for access tokens that can be used by another application. This way you can implement a single sign on flow between e.g. mobile and web.

JavaScript

await exh.auth.oauth1.consumeSsoToken("{ssoTokenHere}");

Tokens

Retrieve a list of active tokens

JavaScript

await exh.auth.oauth1.tokens.find({
  rql: // Optional RQL
});

Revoking tokens

JavaScript

await exh.auth.oauth1.tokens.remove(tokenId);

SSO

Generate SSO Tokens

You can create a single use SSO token. Another client can consume such a token and exchange it for an authorization.

JavaScript

await exh.auth.oauth1.generateSsoToken();