How to enable programmatic access to an API?

[eduard.badillo]

I’m looking for a way to enable users of my application to access the API I provide programmatically.
I have an SPA that authenticates users with Auth0, and an API Gateway (krakend) that takes care of authd/authz.

Now, I’d like to know how to do a flow like an API key/Access tokens with Auth0. Ideally they request a token that last for a certain amount of time and that token is used to make calls to the API.

I’ve looked into creating M2M applications for each user, but doesn’t seem to be the way. Also the quota limit is not suited for this approach.
What other approaches could work for this?

Thanks

[tyf]

Hey there @eduard.badillo welcome to the community!

@eduard.badillo

Now, I’d like to know how to do a flow like an API key/Access tokens with Auth0. Ideally they request a token that last for a certain amount of time and that token is used to make calls to the API.

I’ve looked into creating M2M applications for each user, but doesn’t seem to be the way. Also the quota limit is not suited for this approach.
What other approaches could work for this?

Unfortunately Auth0 does not support API Keys per se, and using a client credential exchange is the best way to go about what you are looking for:

Auth0 Support for API Keys and Personal Access Tokens

Problem statement: Does Auth0 support the concept of API keys or personal access tokens (think GitHub)? Answer: Auth0 does not provide a solution for personal access tokens. If this is something you are interested in, please upvote this feedback request. Regarding API keys: A client credentials grant is more or less equivalent to an API key - The primary difference being that API keys are typically validated by the API itself whereas client credentials are exchanged for a token at an authoriza…

[eduard.badillo]

Hi @tyf,
Thank you for the welcome!

The following looks like what I’m looking for:

using a client credential exchange is the best way to go about what you are looking for

However, I have a few other questions with this approach:

• Looks like I’d need to create one application per user. How would this affect the application quota?
• Should I mark the applications as 3rd party? Do 3rd party applications count towards the application quota?

Thank you for your help!