> ## Documentation Index > Fetch the complete documentation index at: https://help.lobyco.com/llms.txt > Use this file to discover all available pages before exploring further. # Multi-tenant authentication using client credentials flow > Import the Lobyco multi-tenant app into your own Azure AD so you keep full control of the secrets. ## Intro Azure AD multi-tenant authentication using the OAuth 2.0 client credentials flow enables secure and scalable access to APIs across multiple Azure AD tenants. This setup is ideal for scenarios where customers operate their own Azure AD tenants. A key advantage is that customers have control over the secrets associated with their own tenant. This control is crucial for meeting compliance and regulatory requirements, as it allows customers to enforce their own security policies and practices. ## Step by step guide to setup multi-tenant Azure AD authentication ### Contact Lobyco to receive authentication configuration Lobyco needs to create multi-tenant app on it's end and share following configuration values: * `lobyco_app_id` * `lobyco_app_name` * `lobyco_app_uri` ### Import Lobyco multi-tenant app into your active directory In order to see available roles of Lobyco multi-tenant application, service principal should be created in the client's tenant that represents the application from the Lobyco tenant. It can be done using PowerShell script: ```powershell theme={"system"} New-AzureADServicePrincipal -AppId ``` Created service principal can be found by `lobyco_app_name` in Enterprise applications blade in Azure Portal. ### Create single-tenant app in your active directory **Create new app registration** The single-tenant app, which represents the client application in Azure AD, should be registered. Go to App registrations blade in Azure Portal and create new registration.

When you create the application, choose following options: **Name**: Enter a meaningful application name, like `lobyco-api-client-app-{environmentName}` **Account** type: Accounts in this organizational directory only **Redirect URI**: not needed, the client credentials flow doesn't use it. Select **Register** to create the application. On the app **Overview** page, find the **Application (client) ID** value and record it as `client_app_id` for later. You'll need it to pass as parameter to get token endpoint. **Set app credentials: certificate or secret** As with any confidential client application, you need to add a secret or certificate to act as that application's credentials so it can authenticate as itself, without user interaction. Example: Created client secret

Copy the Secret Value and record it as `client_app_secret` for later. You'll need it to pass as parameter to get token endpoint. **Set API permissions** Click Add a permission button and select APIs my organization uses tab. Type `lobyco_app_name` or `lobyco_app_id` value received from Lobyco. Example: a test app ('LoopAppTst' in the screenshots) and its roles:

Select required Application permissions for the client app and grant admin consent. Application permissions require Admin consent. Granting tenant-wide admin consent requires you to sign in as [Global Administrator](https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-assign-admin-roles#global-administrator--company-administrator), an [Application Administrator](https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-assign-admin-roles#application-administrator), or a [Cloud Application Administrator](https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-assign-admin-roles#cloud-application-administrator).

**Edit Manifest** Set accessTokenAcceptedVersion property to '2' in application manifest.

### Get token using secret To get a token by using the client credentials flow, send a POST request to the /token endpoint of Microsoft identity platform: ```http theme={"system"} POST /{client_tenant_id}/oauth2/v2.0/token HTTP/1.1 Host: login.microsoftonline.com Content-Type: application/x-www-form-urlencoded client_id={client_app_id} &scope={lobyco_app_uri}.default &client_secret={client_app_secret} &grant_type=client_credentials ``` Scope should always be equal to `{lobyco_app_uri}.default` regardless which scopes have been configured. Successful response example: ```json theme={"system"} { "token_type": "Bearer", "expires_in": 3599, "ext_expires_in": 3599, "access_token": "{token}" } ``` [Access token](https://jwt.ms/) can be safely decoded using [https://jwt.ms/ .](https://jwt.ms/) Verify that token roles claim contains all selected application roles. ```json theme={"system"} { "typ": "JWT", "alg": "RS256", "kid": "HlC0R12skxNZ1WQwmjOF_6t_tDE" }.{ "aud": "ffc6f3ee-f78d-4fd8-9080-8a2e09b7a680", "iss": "https://login.microsoftonline.com/4c867488-2d0b-43ff-9829-1aa2d7ae43b5/v2.0", "iat": 1580306045, "nbf": 1580306045, "exp": 1580309945, "aio": "42NgYNiR5fpp9pfwV2zf2a0aBHvnAwA=", "azp": "b76cd85d-060c-4616-a8fd-6d1bb7d28c39", "azpacr": "1", "oid": "42604102-34e1-487d-8e10-5f58c6d92243", "roles": [ "Games.MobileAPI" ], "sub": "42604102-34e1-487d-8e10-5f58c6d92243", "tid": "4c867488-2d0b-43ff-9829-1aa2d7ae43b5", "uti": "0qhRSY_TLEyV10Iw7VUgAA", "ver": "2.0" ``` If possible, it's recommended to use the supported [Microsoft Authentication Libraries (MSAL)](https://learn.microsoft.com/en-us/azure/active-directory/develop/scenario-daemon-acquire-token?tabs=dotnet#acquiretokenforclient-api) to get the token instead of protocol directly. ### Use a token Now that you've acquired a token, use the token to make requests to the Lobyco endpoints. Lobyco endpoints expect to receive token in Authorization header: ```http theme={"system"} Authorization: Bearer {token} ``` When the token expires, repeat the request to the /token endpoint to acquire a fresh access token. You are now done.