Authentication

Every content call of the REST API runs as a user of the site, and is checked against that user's roles and policies. With the shipped rest.ini [Authentication] RequireAuthentication=enabled a call needs one of these credentials:

• OAuth 2.0 access token: For: an application that lets other users sign in and act for them; Sent as: Authorization: Bearer <token> or Authorization: OAuth <token>
• Personal API key: For: a script or integration of the user's own; Sent as: Authorization: Bearer expk_...
• User name and password: For: only with AuthenticationStyle=ezpRestBasicAuthStyle; Sent as: HTTP basic authentication

A key or token stops working when its user is disabled or locked. A key is also limited to its scopes, and never goes beyond the owner's policies.

The pages of this section

• OAuth 2.0
• Registering an application
• The authentication process
• Configuring the token expiry time
• Overriding the OAuth sign-in page layout

Two-step sign-in

With basic authentication, an account for which the site requires a second step signs in with its password alone, unless the site opts the REST path in (sevenxauthentication2fa.ini [OtherSignInPaths] Guard[]=rest); then it needs an app password, an API key or an OAuth token. See Second factor on other sign-in paths.

Related pages

• Personal API keys
• REST API v1 and v2, section 3