OAuth2 Authorization Server

Secure authentication and authorization for Worthing & Adur Chamber of Commerce applications and third-party integrations.

Get Started

API Docs

OAuth2 Service

Enterprise-grade authentication

Built on industry standards to provide secure, scalable authentication for all Chamber applications.

Authorization Code Flow: Secure OAuth2 flow for web applications and mobile apps with PKCE support for enhanced security.
Client Credentials Flow: Machine-to-machine authentication for server applications and automated processes.
Refresh Token Support: Long-lived access with secure refresh tokens for seamless user experience.
Chamber Member Integration: Seamlessly integrates with existing Chamber member database and permission system.

Client Management

Authentication Required: Please authenticate to manage OAuth2 clients.

OAuth2 Endpoints

Authorization Endpoint

GET /oauth/authorize

Initiates the authorization code flow. Redirects user to consent page.

Parameters: client_id, response_type, redirect_uri, scope, state, code_challenge, code_challenge_method

Token Endpoint

POST /oauth/token

Exchanges authorization code for access token, or handles client credentials and refresh token flows.

Parameters: grant_type, code, redirect_uri, client_id, client_secret, refresh_token, scope

Token Introspection

POST /oauth/introspect

Validates and returns information about an access token.

Parameters: token, token_type_hint

Token Revocation

POST /oauth/revoke

Revokes an access token or refresh token.

Parameters: token, token_type_hint

Client Management API

Register Client

POST /api/ClientManagement/register

Registers a new OAuth2 client application.

List Clients

GET /api/ClientManagement

Lists all registered OAuth2 clients.

Get Client

GET /api/ClientManagement/{clientId}

Gets details for a specific OAuth2 client.

Update Client

PUT /api/ClientManagement/{clientId}

Updates an existing OAuth2 client.

Delete Client

DELETE /api/ClientManagement/{clientId}

Deletes an OAuth2 client.

Integration Guide

Authorization Code Flow (Recommended)

For web applications and mobile apps that can securely handle redirects:

Step 1: Authorization Request

GET /oauth/authorize?response_type=code&client_id=YOUR_CLIENT_ID&redirect_uri=YOUR_REDIRECT_URI&scope=read write&state=random_state

Step 2: User Authorization

User is redirected to Chamber login and consent page.

Step 3: Authorization Response

YOUR_REDIRECT_URI?code=AUTHORIZATION_CODE&state=random_state

Step 4: Token Exchange

POST /oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code&code=AUTHORIZATION_CODE&redirect_uri=YOUR_REDIRECT_URI&client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET

Step 5: Token Response

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "refresh_token_here",
  "scope": "read write"
}

Client Credentials Flow

For server-to-server authentication:

POST /oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET&scope=read

PKCE Support

For enhanced security with public clients, use PKCE (Proof Key for Code Exchange):

Generate a code verifier (random string)
Create code challenge (SHA256 hash of verifier, base64url encoded)
Include code_challenge and code_challenge_method=S256 in authorization request
Include code_verifier in token exchange request

Available Scopes

Scope	Description	Required Role
read	Read access to profile and membership information	All
write	Write access to update profile information	Member+
profile	Access to basic profile information	All
email	Access to email address	All
events	Access to event registrations	Member+
invoices	Access to invoices and payment history	Member+