System Settings – API Clients

Overview

Registers and manages clients to be allowed OAuth2 authorization access to Questetra APIs.

OAuth2 Clients

photo_library Capture

notification_important Notes

Registering a Client

• [Name] can be anything you choose to identify the client being given API access
• In [Redirect URL], set the redirect URL (callback URL) of the client you want to authorize
• In [Client Authentication Method], you can select how the client is authenticated during token requests
  • client_secret_post: The client is authenticated using a Client Secret. When the client is added, a Client ID and Client Secret will be issued
  • none: This setting is for clients that cannot securely store a Client Secret (public clients). Only a Client ID will be issued; no Client Secret will be issued
• Enabling [Require Proof Key (PKCE)] makes PKCE (Proof Key for Code Exchange) mandatory for the Authorization Code Flow, making the configuration compliant with OAuth 2.1
  • When [Client Authentication Method] is set to none, [Require Proof Key (PKCE)] cannot be disabled
• In [Scope], you can configure the range of API access permitted for the client
  • any (All API Access): Grants full access to the APIs
  • read (Read-only API Access): Restricts access to read-only operations

Configuring the Client System

• Enter the issued Client ID (and Client Secret if using client_secret_post), along with the Authorization Endpoint URL and the Token Endpoint URL, when setting up OAuth communication on the client system

Authorization and Token Validity

• The supported authorization method is the Authorization Code Flow
• Access tokens are valid for 12 hours
• When [Client Authentication Method] is set to client_secret_post, a refresh token is issued along with the access token. Refresh tokens are valid for 35 days
  • Refresh tokens are rotated. Each time a token is refreshed, a new refresh token is issued and the previously used refresh token is invalidated
  • The validity period of a newly issued refresh token is 35 days from the time of issuance. As long as token refreshes continue within 35 days, the authorization state is maintained
  • For a single Client ID, a user can hold up to 10 authorized API sessions (refresh tokens). If the number exceeds 10, the oldest refresh tokens are discarded
• When [Client Authentication Method] is set to none, no refresh token is issued
  • If the access token expires, re-authorize to obtain a new one

Managing Clients

• [Delete OAuth2 Client] will remove that client record from your system
• [Deactivate OAuth2 Client] disables API access but keeps the client details so that it can be reactivated in the future if required via [Activate OAuth2 Client]

balance See also