How to get access token with HMAC algorithm?

[stephanie.chamblee]

You’re very welcome!

@rimpy

It seems to me that i need to first register my API in this case - both for RSA and HMAC?

You can only register an API in Auth0 with one algorithm. In order for your API to support both, you’d probably need to register two APIs in Auth0 and set up your API to use two sets of credentials when initiating whichever Auth0 SDK you are using.

@rimpy

If I use Authorization code grant , what is the validation endpoint url for my access token. The Id token is in jwt format and access token is not in jwt format. For Id token, i can use the endpoint referring to jwks but i dont know which endpoint to use for access token validation.

If your application is an API with no user interface, then Machine to Machine client credentials flow is the way to go. You’d only want to use Authorization Code flow if a user logs into your application. Here is a guide on how to choose which OAuth 2.0 flow to use: Which OAuth 2.0 Flow Should I Use?

If your application is not just an API, but instead has a user interface where end-users must log in, then you’ll need to provide an audience (API identifier) when you initiate the Auth0 SDK. Auth0 will provide an opaque Access Token by default if no audience is specified. If an audience is provided, then it will return a JWT for the Access Token.

Here is an FAQ on opaque versus JWT Access Tokens: Why is my access token not a JWT? (Opaque Token)

Let me know if you have more questions! If you do, could you tell me a bit more about your application (what Auth0 SDK you are using, what kind of OAuth 2 application is it)

Thanks!