Task 1 – Obtain an Access Token

Follow the instructions in the tutorial Create an app to register an app for this tutorial. Note down the Client ID and Client Secret you receive for the app. When specifying details of the app, don’t change the APIs selected by default under API Access.

Before requesting an access token, you’ll need to encode your credentials in a special format to ensure the data you send is secure. This is how you do it:

1. Concatenate your Client ID and Client Secret with a colon character (:) in between, as shown below.

   <CLIENT_ID>:<CLIENT_SECRET>
   
2. Use the appropriate function or method in your preferred programming language to encode the combined string to the Base64 format. Examples:

   Programming Language	Method/Function
   JavaScript	btoa() function
   Python	b64encode() function from the base64 module
   C#	Convert.ToBase64String() method

   JavaScript

   const clientId =  "<CLIENT_ID>";
   const clientSecret =  "<CLIENT_SECRET>";
   const clientAuthKeys =  btoa(clientId +":"+clientSecret);
   

   Python

   import base64
   
   clientId = "<CLIENT_ID>"
   clientSecret = "<CLIENT_SECRET>"
   clientAuthKeys = base64.b64encode((clientId + ":" + clientSecret).encode("ascii")).decode("ascii")
   

   C#

   using System;
   using System.Text;
   
   string clientId = "<CLIENT_ID>";
   string clientSecret = "<CLIENT_SECRET>";
   string combinedKeys = clientId + ":" + clientSecret;
   byte[] bytesToEncode = Encoding.UTF8.GetBytes(combinedKeys);
   string encodedText = Convert.ToBase64String(bytesToEncode);
   

   Show More

   Note: There are online tools that you can use to convert the combined string to a Base64 encoded string. However, we don’t recommend that you use such tools. Exposing your Client ID and Client Secret to an online tool can pose a security threat.

   You should receive a string that looks like RjZEbjh5cGVtMWo4UDZzVXo4SVgzcG1Tc09BOTlHVVQ6QVNOa3c4S3F6MXQwV1hISw==.

Call POST token:

The Base64 encoded Client ID + Client Secret are passed through the Authorization header. The grant_type and scope are specified as form fields in the request body.

curl -v 'https://developer.api.autodesk.com/authentication/v2/token' \
   -X 'POST' \
   -H 'Content-Type: application/x-www-form-urlencoded' \
   -H 'Accept: application/json' \
   -H 'Authorization: Basic <BASE64_ENCODED_STRING_FROM_STEP_1>' \
   -d 'grant_type=client_credentials' \
   -d 'scope=<REQUIRED_SCOPE>'

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, no-store
Content-Type: application/json;charset=UTF-8
Date: Mon, 20 Feb 2017 04:46:41 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
max-age: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Apigee Router
Set-Cookie: PF=2xeh6LTdKKqibsTu9HlyM5;Path=/;Secure;HttpOnly
X-Frame-Options: SAMEORIGIN
Content-Length: 436
Connection: keep-alive

{
  "token_type": "Bearer",
  "expires_in": 1799,
  "access_token": "<ACCESS_TOKEN>"
}