Connecting customers to my API?

Help
,
1

We have set up an API, which we can access using a first-party application using Client Credentials flow i.e. M2M. This all works, very good.

Now we’re looking to allow our customers to access the API using M2M. At no point do we (need to) know who the actual end user is, they will log in to our customers’ application. This application will then to the API calls to us.

In any case the documentation is a bit daunting, and I don’t completely understand what needs to be done. I’m hoping someone can confirm my assertions or point me in the right direction.

If I understand correctly:

  1. Our customers will need a client ID and client secret to request access tokens from Auth0, which they can then use to call our API.
  2. To give our customers this client data, we will need to create a third-party application. (here’s where the docs get a bit confusing, as this page also talks about user consent, which I think is irrelevant in this case?)
  3. We create this third-party application by creating a client using the management API.
  4. Third-party clients cannot be created through the Auth0 dashboard. Except if we hate ourselves and do everything with CLI, we will need to create our own management-application to manage third-party applications.
  5. Ideally our customers need to be able to log in to this management-application to access their credentials themselves. (otherwise we’d need to send them their credentials for example by e-mail, which is less safe)
  6. Created third-party applications do not have access to anything by default. Access to the API needs to be granted through a “client grant”
  7. If we ever want to grant customers access to some of our other API’s, they should get a new set of client id / client secret for each API. This means for a single customer we should be able to have multiple third-party applications.
  8. We can “connect” multiple third-party applications together using an organization. We create these also with the management API. Here I do not see a way to actually connect applications to an organization, is this done with an intermediate step, or some other way?

Is there any sort of documented step-by-step documentation or workflow for this? I can find such steps for creating an application or API, but they all end before the whole third-party access thing.

Thanks for any help.

2

Hey @jeroen welcome to the community!

We unfortunately do not have a step by step guide, but I believe you are on the right track here :slight_smile:

You could do it this way, or authorize the existing m2m client for another API.

Unfortunately, I am not aware of any way to to connect applications to organizations so to speak. Are you able to elaborate a bit more on the use case here? You could take advantage of application_metadata if you are just looking for a way to organize which clients/credentials belong to whom.

Here’s an FAQ on the topic for reference:

1 Like
4

Thanks!

Perhaps I’m overthinking the whole organisations thing.
As it’s the very last thing anyway, I’ll figure it out when we get there.

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.