Skip to main content
There are two types of methods for acquiring tokens. These methods are activated by selecting one of the “Manage From This Policy” or “Manage From ACL” options through the created JWT/OAuth2 Policy. Token acquisition operations will be explained in detail for both methods.

​
1. Token Acquisition with “Manage From This Policy” Option

The ways to obtain client_id and client_secret values according to the management level of the Authentication policy are as follows:
  • If Authentication Policy is Added to API Proxy: client_id and client_secret values are obtained from the “Show Proxy Key” section in the Overview section of the API Proxy.
  • If Authentication Policy is Added to Proxy Group: client_id and client_secret values are obtained from the “Show Proxy Key” section in the Overview section of the API Proxy Group.
  • If Authentication Policy is Added to Policy Group: client_id and client_secret values are obtained from the “Show Proxy Key” section in the Definition section of the relevant Policy Group.

​
1.1 Token Acquisition with JWT

If the “Manage From This Policy” option is selected in the created JWT Policy, tokens are acquired using this method. Prepare a new HTTP request using Apinizer Test Console or another application of your choice.
  • The address should be entered similar to the following according to your own Apinizer access address: https://apinizerErisimAdresiniz/auth/jwt.
If the Allow URL Parameters option is selected, information can be sent using GET method and URL parameters. (See the table below for parameters to be sent)
  • HTTP Method should be POST.
  • “x-www-form-urlencoded” value should be selected in the Body field. If Apinizer Test Console is not used, a header should be added with “Content-Type” name and “application/x-www-form-urlencoded” value.
  • The values to be entered in the Body field are as shown in the table below.
Key NameValue to Enter if “client_credentials” is Selected When Defining PolicyValue to Enter if “password” is Selected When Defining Policy
grant_typeclient_credentialspassword
client_idPublic Key value obtained from API Key fieldPublic Key value obtained from API Key field
client_secretSecret Key value obtained from API Key field”-” (dash)
usernameThis field is not addedUsername of one of the records in the authentication pool you selected
passwordThis field is not addedPassword of one of the records in the authentication pool you selected

​
Token Refresh

If the Token Should Be Immortal option is closed and the Token Refresh Should Be option is opened, tokens that will become invalid after a certain period can be refreshed within the period specified in the Refreshed Token Validity Period field. Prepare a new HTTP request using Apinizer Test Console or another application of your choice.
  • The address should be entered similar to the following according to your own Apinizer access address: https://apinizerErisimAdresiniz/auth/jwt.
If the Allow URL Parameters option is selected, information can be sent using GET method through URL parameters. (See the table below for parameters to be sent).
  • HTTP Method should be POST.
  • “x-www-form-urlencoded” value should be selected in the Body field. If Apinizer Test Console is not used, a header should be added with “Content-Type” name and “application/x-www-form-urlencoded” value.
  • The values to be entered in the Body field are as shown in the table below.
Key NameKey Value
grant_typerefresh_token
client_idPublic Key value obtained from API Key field
client_secret”-” (dash)
refresh_tokenValue in the “refresh_token” key in the previously acquired token

​
If grant_type is client_credentials

Add a JWT Authentication policy with default values. While doing this, copy your API Key information to use. Send your token acquisition request with a message like the example below. The image containing the settings for sending a request to Token Service through Apinizer Test Console is shown below: JWT Client Credentials Token Request The value in the “access_token” field in the response message, when given as a value to the “Authorization” key in all requests to be sent to this API Proxy, provides secure access to the relevant API. The image containing the operation of sending a request with token information through Apinizer Test Console is shown below: Sending Request with JWT Token

​
If grant_type is password

Add a JWT Authentication policy with Grant Type value Password. While doing this, copy your API Key information to use. Send your token acquisition request with a message like the example below. The image containing the settings for sending a request to Token Service through Apinizer Test Console is shown below: JWT Password Token Request The value in the “access_token” field in the response message, when given as a value to the “Authorization” key in all requests to be sent to this API Proxy, provides secure access to the relevant API. The image containing the operation of sending a request with token information through Apinizer Test Console is shown below: Sending Request with JWT Password Token

​
If grant_type is refresh_token

Add a JWT Authentication policy with refresh option enabled. While doing this, copy your API Key information to use. Send your token acquisition request with a message like the example below. The image containing the settings for sending a request to Token Service through Apinizer Test Console is shown below: JWT Refresh Token Request To refresh the token, take the value in the “refresh_token” field in the response from the first request and give it as a value to the refresh_token key in the message you prepared as below. The value in the “access_token” field in the response to come will be your refreshed token value. The image containing the example request sent to refresh the token through Apinizer Test Console is shown below: JWT Refresh Token Refresh

​
1.2 Token Acquisition with OAuth2

If the “Manage From This Policy” option is selected in the created OAuth2 Policy, tokens are acquired using this method. Prepare a new HTTP request using Apinizer Test Console or another application of your choice.
  • The address should be entered similar to the following according to your own Apinizer access address: https://apinizerErisimAdresiniz/auth/token.
If the Allow URL Parameters option is selected, information can be sent using GET method and URL parameters. (See the table below for parameters to be sent)
  • HTTP method should be POST.
  • “x-www-form-urlencoded” value should be selected in the Body field. If Apinizer Test Console is not used, a header should be added with “Content-Type” name and “application/x-www-form-urlencoded” value.
  • The values to be entered in the Body field are as shown in the table below.
Key NameValue to Enter if “client_credentials” is Selected When Defining PolicyValue to Enter if “password” is Selected When Defining Policy
grant_typeclient_credentialspassword
client_idPublic Key value obtained from API Key fieldPublic Key value obtained from API Key field
client_secretSecret Key value obtained from API Key fieldSecret Key value obtained from API Key field
usernameThis field is not addedUsername of one of the records in the authentication pool you selected
passwordThis field is not addedPassword of one of the records in the authentication pool you selected

​
Token Refresh

If the Token Should Be Immortal option is closed and the Token Refresh Should Be option is opened, tokens that will become invalid after a certain period can be refreshed within the period specified in the Refreshed Token Validity Period field. Prepare a new HTTP request using Apinizer Test Console or another application of your choice.
  • The address should be entered similar to the following according to your own Apinizer access address: https://apinizerErisimAdresiniz/auth/token.
If the Allow URL Parameters option is selected, information can be sent using GET method through URL parameters. (See the table below for parameters to be sent).
  • HTTP method should be POST.
  • “x-www-form-urlencoded” value should be selected in the Body field. If Apinizer Test Console is not used, a header should be added with “Content-Type” name and “application/x-www-form-urlencoded” value.
  • The values to be entered in the Body field are as shown in the table below
Key NameKey Value
grant_typerefresh_token
client_idPublic Key value obtained from API Key field
client_secretSecret Key value obtained from API Key field
refresh_tokenValue in the “refresh_token” key in the previously acquired token

​
If grant_type is client_credentials

Add an OAuth2 Authentication policy with default values. While doing this, copy your API Key information to use. Send your token acquisition request with a message like the example below. The image containing the settings for sending a request to Token Service through Apinizer Test Console is shown below: OAuth2 Client Credentials Token Request The value in the “access_token” field in the response message, when given as a value to the “Authorization” key in all requests to be sent to this API Proxy, provides secure access to the relevant API. The image containing the operation of sending a request with token information through Apinizer Test Console is shown below: Sending Request with OAuth2 Token

​
If grant_type is password

Add an OAuth2 Authentication policy with Grant Type value Password. While doing this, copy your API Key information to use. Send your token acquisition request with a message like the example below. The image containing the settings for sending a request to Token Service through Apinizer Test Console is shown below: OAuth2 Password Token Request The value in the “access_token” field in the response message, when given as a value to the “Authorization” key in all requests to be sent to this API Proxy, provides secure access to the relevant API. The image containing the operation of sending a request with token information through Apinizer Test Console is shown below: Sending Request with OAuth2 Password Token

​
GrantType: Refresh Token

Add an OAuth2 Authentication policy with refresh option enabled. While doing this, copy your API Key information to use. Send your token acquisition request with a message like the example below. The image containing the settings for sending a request to Token Service through Apinizer Test Console is shown below: OAuth2 Refresh Token Request To refresh the token, take the value in the “refresh_token” field in the response from the first request and give it as a value to the refresh_token key in the message you prepared as below. The value in the “access_token” field in the response to come will be your refreshed token value. The image containing the example request sent to refresh the token through Apinizer Test Console is shown below: OAuth2 Refresh Token Refresh

​
1.3 Token Acquisition with Scope

Prepare a new HTTP request using Apinizer Test Console or another application of your choice.
  • The address should be entered similar to the following according to your own Apinizer access address: https://apinizerErisimAdresiniz/auth/jwt.
  • HTTP Method should be POST. “x-www-form-urlencoded” value should be selected in the Body field. If Apinizer Test Console is not used, a header should be added with “Content-Type” name and “application/x-www-form-urlencoded” value.
  • The values to be entered in the Body field are as shown in the table below
Key NameValue to Enter if “client_credentials” is Selected When Defining PolicyValue to Enter if “password” is Selected When Defining Policy
grant_typeclient_credentialspassword
client_idPublic Key value obtained from API Key fieldPublic Key value obtained from API Key field
client_secretSecret Key value obtained from API Key field”-” (dash)
usernameThis field is not addedUsername of one of the records in the authentication pool you selected
passwordThis field is not addedPassword of one of the records in the authentication pool you selected
scopeRole name defined for the userRole name defined for the user

​
Defining Role for User

To define a role for the user, a new role should be added from the roles section as below and that Proxy should be added to the user from the API Proxy ACL section. Role Definition with Scope

​
If grant_type is client_credentials

Add a JWT Authentication policy with default values. While doing this, copy your API Key information to use. Send your token acquisition request with a message like the example below. The image containing the settings for sending a request to Token Service through Apinizer Test Console is shown below: Client Credentials Token Request with Scope The value in the “access_token” field in the response message, when given as a value to the “Authorization” key in all requests to be sent to this API Proxy, provides secure access to the relevant API. The image containing the operation of sending a request with token information through Apinizer Test Console is shown below: Token Usage with Scope

​
If grant_type is password

Add a JWT Authentication policy with Grant Type value Password. While doing this, copy your API Key information to use. Send your token acquisition request with a message like the example below. The image containing the settings for sending a request to Token Service through Apinizer Test Console is shown below: Password Token Request with Scope The value in the “access_token” field in the response message, when given as a value to the “Authorization” key in all requests to be sent to this API Proxy, provides secure access to the relevant API. The image containing the operation of sending a request with token information through Apinizer Test Console is shown below: Password Token Usage with Scope Password Token Usage with Scope 2

​
2. Token Acquisition with “Manage From ACL” Option

​
2.1 Token Acquisition with JWT

If the “Manage From ACL” option is selected in the created JWT Policy, tokens are acquired using this method. Prepare a new HTTP request using Apinizer Test Console or another application of your choice.
  • The address should be entered similar to the following according to your own Apinizer access address: https://apinizerErisimAdresiniz/credential/jwt.
If the Allow URL Parameters option is selected, information can be sent using GET method and URL parameters. (See the table below for parameters to be sent)
  • HTTP Method should be POST.
  • “x-www-form-urlencoded” value should be selected in the Body field. If Apinizer Test Console is not used, a header should be added with “Content-Type” name and “application/x-www-form-urlencoded” value.
  • The values to be entered in the Body field are as shown in the table below.
Key NameValue to Enter if “client_credentials” is Selected When Defining PolicyValue to Enter if “password” is Selected When Defining Policy
grant_typeclient_credentialspassword
client_idClient Id value belonging to CredentialsClient Id value belonging to Credentials
client_secretClient Secret value belonging to CredentialsClient Secret value belonging to Credentials
usernameThis field is not addedUsername of one of the records in the authentication pool you selected
passwordThis field is not addedPassword of one of the records in the authentication pool you selected

​
Token Refresh

If the Token Should Be Immortal option is closed and the Token Refresh Should Be option is opened, tokens that will become invalid after a certain period can be refreshed within the period specified in the Refreshed Token Validity Period field. Prepare a new HTTP request using Apinizer Test Console or another application of your choice.
  • The address should be entered similar to the following according to your own Apinizer access address: https://apinizerErisimAdresiniz/credential/jwt.
If the Allow URL Parameters option is selected, information can be sent using GET method through URL parameters. (See the table below for parameters to be sent).
  • HTTP Method should be POST.
  • “x-www-form-urlencoded” value should be selected in the Body field. If Apinizer Test Console is not used, a header should be added with “Content-Type” name and “application/x-www-form-urlencoded” value.
  • The values to be entered in the Body field are as shown in the table below.
Key nameKey Value
grant_typerefresh_token
client_idClient Id value belonging to Credentials
client_secretClient Secret value belonging to Credentials
refresh_tokenValue in the “refresh_token” key in the previously acquired token

​
If grant_type is client_credentials

Add a JWT Authentication policy with Manage From ACL option. Go to Token Settings panel from Credential screen and save default values. Send your token acquisition request with a message like the example below. The image containing the settings for sending a request to Token Service through Apinizer Test Console is shown below: ACL JWT Client Credentials Token Request The value in the “access_token” field in the response message, when given as a value to the “Authorization” key in all requests to be sent to this API Proxy, provides secure access to the relevant API. The image containing the operation of sending a request with token information through Apinizer Test Console is shown below: Sending Request with ACL JWT Token

​
If grant_type is password

Add a JWT Authentication policy with Manage From ACL option. Go to Token Settings panel from Credential screen, select Grant Type value as Password and save. Send your token acquisition request with a message like the example below. The image containing the settings for sending a request to Token Service through Apinizer Test Console is shown below: ACL JWT Password Token Request The value in the “access_token” field in the response message, when given as a value to the “Authorization” key in all requests to be sent to this API Proxy, provides secure access to the relevant API. The image containing the operation of sending a request with token information through Apinizer Test Console is shown below: Sending Request with ACL JWT Password Token

​
If grant_type is refresh_token

Add a JWT Authentication policy with Manage From ACL option. Go to Token Settings panel from Credential screen, enable Token Refresh option and save. Send your token acquisition request with a message like the example below. The image containing the settings for sending a request to Token Service through Apinizer Test Console is shown below: ACL JWT Refresh Token Request To refresh the token, take the value in the “refresh_token” field in the response from the first request and give it as a value to the refresh_token key in the message you prepared as below. The value in the “access_token” field in the response to come will be your refreshed token value. The image containing the example request sent to refresh the token through Apinizer Test Console is shown below: ACL JWT Refresh Token Refresh

​
2.2 Token Acquisition with OAuth2

If the “Manage From ACL” option is selected in the created OAuth2 Policy, tokens are acquired using this method. Prepare a new HTTP request using Apinizer Test Console or another application of your choice.
  • The address should be entered similar to the following according to your own Apinizer access address: https://apinizerErisimAdresiniz/credential/token.
If the Allow URL Parameters option is selected, information can be sent using GET method and URL parameters. (See the table below for parameters to be sent)
  • HTTP method should be POST.
  • “x-www-form-urlencoded” value should be selected in the Body field. If Apinizer Test Console is not used, a header should be added with “Content-Type” name and “application/x-www-form-urlencoded” value.
  • The values to be entered in the Body field are as shown in the table below.
Key NameValue to Enter if “client_credentials” is Selected When Defining PolicyValue to Enter if “password” is Selected When Defining Policy
grant_typeclient_credentialspassword
client_idClient Id value belonging to CredentialsClient Id value belonging to Credentials
client_secretClient Secret value belonging to CredentialsClient Secret value belonging to Credentials
usernameThis field is not addedUsername of one of the records in the authentication pool you selected
passwordThis field is not addedPassword of one of the records in the authentication pool you selected

​
Token Refresh

If the Token Should Be Immortal option is closed and the Token Refresh Should Be option is opened, tokens that will become invalid after a certain period can be refreshed within the period specified in the Refreshed Token Validity Period field. Prepare a new HTTP request using Apinizer Test Console or another application of your choice.
  • The address should be entered similar to the following according to your own Apinizer access address: https://apinizerErisimAdresiniz/credential/token.
If the Allow URL Parameters option is selected, information can be sent using GET method through URL parameters. (See the table below for parameters to be sent).
  • HTTP method should be POST.
  • “x-www-form-urlencoded” value should be selected in the Body field. If Apinizer Test Console is not used, a header should be added with “Content-Type” name and “application/x-www-form-urlencoded” value.
  • The values to be entered in the Body field are as shown in the table below
Key NameKey Value
grant_typerefresh_token
client_idClient Id value belonging to Credentials
client_secretClient Secret value belonging to Credentials
refresh_tokenValue in the “refresh_token” key in the previously acquired token

​
If grant_type is client_credentials

Add an OAuth2 Authentication policy with Manage From ACL option. Go to Token Settings panel from Credential screen and save default values. Send your token acquisition request with a message like the example below. The image containing the settings for sending a request to Token Service through Apinizer Test Console is shown below: ACL OAuth2 Client Credentials Token Request The value in the “access_token” field in the response message, when given as a value to the “Authorization” key in all requests to be sent to this API Proxy, provides secure access to the relevant API. The image containing the operation of sending a request with token information through Apinizer Test Console is shown below: Sending Request with ACL OAuth2 Token

​
If grant_type is password

Add an OAuth2 Authentication policy with Manage From ACL option. Go to Token Settings panel from Credential screen, select Grant Type value as Password and save. Send your token acquisition request with a message like the example below. The image containing the settings for sending a request to Token Service through Apinizer Test Console is shown below: ACL OAuth2 Password Token Request The value in the “access_token” field in the response message, when given as a value to the “Authorization” key in all requests to be sent to this API Proxy, provides secure access to the relevant API. The image containing the operation of sending a request with token information through Apinizer Test Console is shown below: Sending Request with ACL OAuth2 Password Token

​
If grant_type is refresh_token

Add an OAuth2 Authentication policy with Manage From ACL option. Go to Token Settings panel from Credential screen, enable Token Refresh option and save. Send your token acquisition request with a message like the example below. The image containing the settings for sending a request to Token Service through Apinizer Test Console is shown below: ACL OAuth2 Refresh Token Request To refresh the token, take the value in the “refresh_token” field in the response from the first request and give it as a value to the refresh_token key in the message you prepared as below. The value in the “access_token” field in the response to come will be your refreshed token value. The image containing the example request sent to refresh the token through Apinizer Test Console is shown below: ACL OAuth2 Refresh Token Refresh