OAuth 2.0 client credentials flow
This is the scheme for server-to-server calls. Lobyco implements the OAuth 2.0 client credentials flow on the Microsoft identity platform. Your service authenticates with an app id and a secret, gets an access token, and sends it with every request. The Lobyco API validates the token’s issuer, audience and roles before it runs the request.
Choose a tenant setup
The app registration your service authenticates as lives in one of two tenants. Which one decides who creates it and who holds its secret.
Both setups end in the same token request, and the Lobyco APIs treat the tokens alike.
API key
An API key is weaker than a token: it is a fixed string, and it does not expire on its own. It still has a place. A POS, for example, may not be able to cache a token and renew it before it expires. For that case Lobyco can issue an API key instead. Ask Lobyco for one, and say which IP addresses will use it. Lobyco can limit the key to those addresses, which is the extra measure that makes a key acceptable.Related
- Lobyco tenant authentication using client credentials flow — the token request, with the app registration Lobyco created for you.
- Multi-tenant authentication using client credentials flow — importing the Lobyco app into your own Azure AD and registering your client app.
- API integration — the Front Door address ranges your firewall must allow.