Creating OAuth Clients

Because the root client's token contains all scopes, it can create new clients and new client ID/client secret pairs which can be used to create additional access tokens.

Prerequisites

In order to complete this, you will need one of the following:

• A valid access_token created from a client credentials with adequate scopes to create additional clients. Read how to generate an access token here.

Example: Create new OAuth Client

To create a new client ID and client secret, make POST request to the /api/v1/oauth/client endpoint using an access token with appropriate scopes as shown in the example below:

curl 'http://localhost:8080/api/v1/oauth/client' \
-X POST \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer {{FIDES_ACCESS_TOKEN}}' \
-d '["policy:read", "rule:read"]'

The Authorization header should be Bearer, where {{FIDES_ACCESS_TOKEN}} is your access token and the request Content-Type should be application/json.

To add scopes to the client, the body of your request must contain an array of scopes in the form key: scope_value.

In the above example, the new access token only lets the client read policies and rules. The client cannot create other clients, write policies, or perform other operations using Fides APIs.

A successful request to Fides will respond with a new client ID client secret pair similar to the example below:

HTTP/1.1 200 OK
Content-Type: application/json
 
{
  "client_id" : "c0508a70e08f9f49de23eace66664d1d",
  "client_secret" : "5fac65211cbd005b390c073b3912af14",
}

Create an access token

You can then create an access token for the client credentials by calling POST /api/v1/oauth/token with the new credentials and following the steps to generate a token here.