Skip to main content

Service authentication

This guide explains how to use OAuth 2.0 authentication to protect your Automator services using the Client Credentials Grant flow as defined in RFC 6749 Section 4.4.

Table of contents​

Overview​

OAuth 2.0 authentication provides a secure way to protect your service endpoints using industry-standard token-based authentication. When a service is protected with OAuth, external applications must:

  1. Obtain an access token using valid OAuth credentials
  2. Include the access token in the Authorization header when calling the service
  3. Refresh the token before it expires (tokens are valid for 1 hour)

Setting Up OAuth for a Service​

Step 1: Configure Service Authentication​

  1. Open your profile in the Automator web interface
  2. Navigate to the Services section
  3. Select the service you want to protect
  4. In the Authentication Method dropdown, select OAuth 2.0 (Client Credentials)

Step 2: Generate OAuth Credentials​

  1. Click the Add button next to the dropdown
  2. The system will generate:
    • Client ID: A unique identifier (starts with svc_)
    • Client Secret: A secret key for authentication
  3. IMPORTANT: Copy the client secret immediately - it will not be shown again
  4. Store both the client ID and secret securely
  5. Save your profile

The service endpoint is now protected using OAuth 2.0.

Using OAuth Authentication​

Step 1: Obtain an Access Token​

External applications must first obtain an access token by calling the OAuth endpoint:

curl -X POST https://automator.example.com/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=svc_abc123..." \
  -d "client_secret=def456..." \
  -d "service_uuid=12345678-1234-1234-1234-123456789abc" \
  -d "profile=my-profile" \
  -d "environment=production"

Success Response:

{
  "access_token": "eyJhbGciOiJSUzI1Ni...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "service:call"
}

Access tokens are valid for 1 hour (3600 seconds). Applications should check the expires_in field in the token response and request a new token before the current one expires.

Step 2: Call the Protected Service​

Use the access token in the Authorization header when calling your service:

curl -X POST https://automator.example.com/service/my-profile/production/json/my-service \
  -H "Authorization: Bearer eyJhbGciOiJSUzI1Ni..." \
  -H "Content-Type: application/json" \
  -d '{"data": "value"}'

Managing OAuth Credentials​

Viewing Credentials​

In the service editor, you can see:

  • All active credentials for the service
  • The client ID for each credential
  • When each credential was created

Note: Client secrets are only shown once during generation for security reasons.

Deleting Credentials​

To remove a credential:

  1. Click the "Remove" button next to the credential
  2. Confirm the deletion
  3. Save your profile

Warning: Deleting a credential will immediately invalidate all tokens issued with it.

Credential Rotation​

Services support up to 2 credentials simultaneously for seamless rotation.

To rotate credentials without downtime:

  1. Generate a new credential while keeping the old one active
  2. Update your applications to use the new credential
  3. Verify all applications are using the new credential
  4. Delete the old credential