Resource Owner Password Flow

Due to the fact that the Resource Owner Password (ROP) Flow requires the application to handle the user's password, it is not recommended for third-party clients to use.

Check the RFC6749 for a detailed flow description. This flow is restricted to securely hosted first-party services for which no other authorization flow can be used. Only client ids that are enabled for the use of this authorization flow can be used. Only user credentials that are directly stored in the ezeep ID Server can use this flow (i.e. no 3rd party authentication will be accepted).

Getting Access Token using Username and Password

Use this step only as a start/fallback procedure to initially retrieve a valid access and refresh token or in case of a refresh token that got lost or became invalid. There may be limitations or delays imposed on the usage of the API call.

POST https://account.ezeep.com/oauth/access_token/

Supported attributes:

Attribute	Type	Required	Description
`Authorization`	HTTP Header	Yes	Basic {{base_64_encoded_client_id}}
`Content-Type`	HTTP Header	Yes	`application/x-www-form-urlencoded`
`grant_type`	string	Yes	`password`
`scope`	string	No	`printing` (space separated scope list)
`username`	string	Yes	the user name of credentials
`password`	string	Yes	the password of credentials

If successful, returns HTTP status code 200 OK and the following response attributes:

Attribute	Type	Description
`access_token`	string	the access token that is required in Authorization header of API requests
`token_type`	string	for ezeep always “Bearer”, has to be passed in Authorization header
`expires_in`	int	validity time in seconds of the access token
`scope`	string	scope(s) of token
`refresh_token`	string	refresh token, to be used for getting a new access token

Example Request

curl -X POST "https://account.ezeep.com/oauth/access_token/" \
     --header "Authorization: Basic <base64_encoded_client_id>" \
     --header "Content-Type: application/x-www-form-urlencoded" \
     --data-urlencode "grant_type=password" \
     --data-urlencode "username=user@example.com" \
     --data-urlencode "password=secretPw" \
     --data-urlencode "scope=printing"

Example Response

{
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJodHRwczovL2FjY291bnQu...u0oEBY34y2Im39-l6PtCEHXor3xEpnBKAOPh72QQ",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "printing",
  "refresh_token": "F2UuSA...zrhg15MA"
}

The access_token will be valid for 3600 seconds (i.e. 1 hour) and after that duration you have to request new access token using the refresh token that you received in the access token response.

Use Refresh Token

You can use the refresh_token to get a new access_token. Reuse the access token until it expires; do not request a new access token for every API call. Rate limiting may be applied to this endpoint.

Revoke the refresh token when your application no longer needs it, see Token Revocation.

To refresh your token, send a POST request to /oauth/access_token/ with grant_type=refresh_token.

curl -X POST https://account.ezeep.com/oauth/access_token/

Supported attributes:

Attribute	Parameter Type	Required	Description
`Authorization`	HTTP Header	yes	Basic {{base_64_encoded_client_id}}
`Content-Type`	HTTP Header	yes	`application/x-www-form-urlencoded`
`grant_type`	string	yes	`refresh_token`
`scope`	string	no	`printing` (space separated scope list); can only narrow the granted scopes
`refresh_token`	string	yes	refresh_token obtained by last (token rotation) call to /oauth/access_token/

Example Request

curl -X POST "https://account.ezeep.com/oauth/access_token/" \
     --header "Authorization: Basic <base64_encoded_client_id>" \
     --header "Content-Type: application/x-www-form-urlencoded" \
     --data "grant_type=refresh_token" \
     --data "scope=printing" \
     --data "refresh_token=qX5HTLt4..."

Example Response

{
  "access_token": "eyJ0eXAiOiJ...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "printing",
  "refresh_token": "vT5GTKk8..."
}

You will need to replace and store the new refresh token securely from the response for future usage.

Switch Organizations

To get tokens for another organization, see Switch Organizations.