OAUTH 2.0

Exponential 6 is an OAuth 2.0 authorization server for its REST API. It supports the authorization code grant, with PKCE (RFC 7636) and the state parameter, and the refresh token grant. Applications are registered by an administrator; users authorize them in the browser.

• Authorize page: https://www.example.com/oauth/authorize (policy oauth/authorize).
• Token endpoint: POST https://www.example.com/api/auth/v1/oauth/token.
• Access tokens last TokenTTL seconds (one hour by default), refresh tokens RefreshTokenTTL (30 days).
• An application stored without a secret is a public client (a mobile or browser app); it must use PKCE. Applications made in Setup > oAuth admin have a secret.

Next: register the application, then follow the authentication process.

Related pages

• PKCE and state for the OAuth authorization server
• OAuth token hardening
• The oauth/authorize policy