Authentication and Authorization

The Procurement Service Bus API uses OAuth 2.0 bearer tokens. Two flows are supported:

• Client Credentials Grant - machine-to-machine authentication.
• Resource Owner Password Credentials Grant - user-based authentication.

Getting a client

To use the Client Credentials flow you need a client id and client secret. Request a client from eConnect Tech Support. Access to your parties is then granted to this client.

Keep the client secret on your server. Never put it in a browser application, mobile app or source control. The only exception is the Swagger page, where you can enter it to try out the API. There the secret is only sent to the identity server and is not stored.

Requesting a bearer token

Request

POST https://accp-identity.econnect.eu/connect/token HTTP/1.1
Accept: application/json
Content-Type: application/x-www-form-urlencoded
Host: accp-identity.econnect.eu

grant_type=client_credentials&scope=ap&client_id={clientId}&client_secret={clientSecret}

For the production environment use https://identity.econnect.eu (opens new window).

grant_type=client_credentials Selects the Client Credentials flow.

scope=ap Specifies that the Access Point functionality is used.

client_id={clientId}&client_secret={clientSecret} Authenticates your client.

Response:

    {"access_token":"eyJhbGciOiJSUzI1NiIsImtpZ...pjw","expires_in":3600,"token_type":"Bearer"}

Reuse the token until it expires (expires_in is in seconds) instead of requesting a new token for every call.

Resource Owner Password

To authenticate with a user instead of a client, use the password flow:

grant_type=password&scope=ap&username={userName}&password={userSecret}&client_id={clientId}&client_secret={clientSecret}

username={userName}&password={userSecret} Specifies the user that is authorized for a specific party.

Using the bearer and subscription

A bearer token must be included with every request to the PSB. In addition, an optional subscription key provided for your organisation may be added as a header.

GET https://accp-psb.econnect.eu/api/v1/{API call} HTTP/1.1
Authorization: Bearer eyJhbGciOiJSUzI1NiIsImtpZ...pjw
Subscription-Key: {SubscriptionKey}
Host: accp-psb.econnect.eu

For the production environment use https://psb.econnect.eu (opens new window).

C# examples

Using the official .NET client

The EConnect.Psb (opens new window) package requests and refreshes the token for you. When no username and password are configured, it uses the Client Credentials flow.

builder.Services.AddPsbService(_ =>
{
    _.PsbUrl = "https://accp-psb.econnect.eu"; // Production: https://psb.econnect.eu
    _.IdentityUrl = "https://accp-identity.econnect.eu"; // Production: https://identity.econnect.eu
    _.ClientId = "{clientId}";
    _.ClientSecret = "{clientSecret}";
    _.SubscriptionKey = "{subscriptionKey}"; // Optional
});

See the package documentation (opens new window) for more details.

Requesting a token yourself

using IdentityModel.Client;

var httpClient = new HttpClient();

var response = await httpClient.RequestClientCredentialsTokenAsync(new ClientCredentialsTokenRequest
{
    Address = "https://accp-identity.econnect.eu/connect/token", // Production: https://identity.econnect.eu/connect/token
    ClientId = "{clientId}",
    ClientSecret = "{clientSecret}",
    Scope = "ap"
});

if (response.IsError || response.AccessToken == null)
{
    // handle error
}

httpClient.SetBearerToken(response.AccessToken);
var me = await httpClient.GetStringAsync("https://accp-psb.econnect.eu/api/v1/me"); // Production: https://psb.econnect.eu

Package needed: IdentityModel (opens new window)