Authentication
Standards-based authentication and authorization for the SweetConnect APIs
Standards
SweetConnect provides a standards-based identity and authorization service. Authentication and token-based access are based on established OAuth 2.0 and OpenID Connect standards.
Clients can use standard OAuth 2.0 and OpenID Connect libraries to interact with the identity service. Access tokens are sent to protected API endpoints using the OAuth 2.0 Bearer authentication scheme.
OAuth 2.1 is still under development. Any related capabilities enforced for a client depend on its SweetConnect configuration.
OpenID Connect Discovery
SweetConnect publishes its OpenID Connect configuration through a standard discovery endpoint.
Issuer
https://iam.my.sweetconnect.io/realms/sweetconnect-prodDiscovery endpoint
https://iam.my.sweetconnect.io/realms/sweetconnect-prod/.well-known/openid-configurationThe discovery document provides the currently available endpoints and supported protocol capabilities. OAuth and OpenID Connect clients should use this metadata instead of relying on manually constructed endpoint URLs.
Common Integration Endpoints
The following selection covers endpoints commonly used by API clients and integrations. The discovery document provides the complete list of currently available endpoints.
| Endpoint | URL | Purpose |
|---|---|---|
| Token | https://iam.my.sweetconnect.io/realms/sweetconnect-prod/protocol/openid-connect/token | Obtain an access token or renew it using a refresh token |
| Logout | https://iam.my.sweetconnect.io/realms/sweetconnect-prod/protocol/openid-connect/logout | End an OpenID Connect session |
| JWKS | https://iam.my.sweetconnect.io/realms/sweetconnect-prod/protocol/openid-connect/certs | Public keys for validating signed tokens |
| Introspection | https://iam.my.sweetconnect.io/realms/sweetconnect-prod/protocol/openid-connect/token/introspect | Check token status and metadata |
| Revocation | https://iam.my.sweetconnect.io/realms/sweetconnect-prod/protocol/openid-connect/revoke | Revoke access or refresh tokens |
Authentication Capabilities
SweetConnect clients are configured according to their integration type. Not every authentication capability is enabled for every client.
| Capability | Typical use |
|---|---|
| Client Credentials Flow | Service-to-service integrations without user interaction |
| Authorization Code Flow with PKCE | Applications acting on behalf of a signed-in user |
| Refresh Tokens | Renewing access tokens without repeating user authentication |
| Device Authorization Grant | Authentication on devices with limited input capabilities |
| Token Exchange | Exchanging an existing token for a token intended for another context |
Password-based grants are not intended for new integrations. Client credentials, scopes, roles, and enabled capabilities are provided as part of the SweetConnect integration setup.
Authenticating API Requests
Protected SweetConnect API endpoints require an OAuth 2.0 access token. Send the token as a Bearer token in the Authorization header of every request.
The following example obtains an access token using the Client Credentials Flow:
curl --request POST \
--url https://iam.my.sweetconnect.io/realms/sweetconnect-prod/protocol/openid-connect/token \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'client_id=<client_id>' \
--data-urlencode 'client_secret=<client_secret>'Keep client credentials secure
Client secrets must only be used in trusted server-side environments and must never be exposed in browser or mobile application code.
A successful response contains the access token:
{
"access_token": "<access_token>",
"token_type": "Bearer"
}Use the value of access_token when calling a protected API endpoint:
curl --request GET \
--url <api-endpoint> \
--header 'Authorization: Bearer <access_token>'This example represents a typical service-to-service integration. Client credentials, scopes, and enabled capabilities are provided as part of the SweetConnect integration setup.