Skip to content
Authentication/
/
Client Credentials
Last updated

Client Credentials Flow (for Server-to-Server and Anonymous Customers)

This flow is used for machine-to-machine communication where the application authenticates itself directly without a user present.

For a Client App (Server-to-Server)

This is the standard flow for backend services.

  • Method: POST

  • Endpoint: Your Token URL (from your client application's metadata).

    • Example Token URL for a Client App:
      https://ai.egain.cloud/system/auth/TMPRODB88619984-U/oauth2/token

Headers:

HeaderValue
Content-Typeapplication/x-www-form-urlencoded

Body Parameters (application/x-www-form-urlencoded):

ParameterRelevanceDescription
grant_typeRequiredMust be set to client_credentials.
scopeRequiredA space-separated list of scopes. You can include any combination of scopes assigned to your client application in a single request. This allows you to generate one multi-purpose token for your entire application, or separate tokens for specific tasks, depending on your architectural needs.
client_idRequiredThe Client ID for your application.
client_secretRequiredThe Client Secret for your application.
  • Example Full Token cURL for a Client App:
curl --location --request POST 'https://ai.egain.cloud/system/auth/TMPRODB88619984-U/oauth2/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'scope=knowledge.portalmgr.manage' \
--data-urlencode 'client_id=b4b2c1d9-4c19-4e8a-8e7a-9a0b1c2d3e4f' \
--data-urlencode 'client_secret=hh2Y0UE8FmaFBBawzMUua1OB8Ks4QWHNUyhDyZj1X7c'

For an Anonymous Customer

This flow is a specific implementation of client credentials to get a token for an anonymous customer.

  • Method: POST

  • Endpoint: https://api.ai.egain.cloud/core/authmgr/v3/oauth2/v2.0/anonymous/token?user_type=customer&domain_hint=<TENANT_ID>

    • Example Token URL for an Anonymous Customer:
      https://api.ai.egain.cloud/core/authmgr/v3/oauth2/v2.0/anonymous/token?user_type=customer&domain_hint=TMPRODB88619984

Query Parameters:

ParameterRelevanceDescription
user_typeRequiredMust be set to customer.
domain_hintRequiredMust be set to your environment's tenant id. This is the id that is present in all authorization and access token URLs from your client application's metadata. i.e, TMPRODB88619984 of https://ai.egain.cloud/system/auth/TMPRODB88619984-C/oauth2/token

Body Parameters (application/x-www-form-urlencoded):

ParameterRelevanceDescription
grant_typeRequiredMust be set to client_credentials.
client_idRequiredThe Client ID for your application.
client_secretRequiredThe Client Secret for your application.
scopeRequiredA space-separated list of application permissions required for anonymous access. For anonymous customer, each scope will need to be prefixed with https://api.ai.egain.cloud/auth/, i.e, https://api.ai.egain.cloud/auth/knowledge.portalmgr.read
  • Example Full Token cURL for an Anonymous Customer
curl --location --request POST 'https://api.ai.egain.cloud/core/authmgr/v3/oauth2/v2.0/anonymous/token?user_type=customer&domain_hint=TMPRODB88619984' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'client_id=************************************' \
--data-urlencode 'client_secret=************************************' \
--data-urlencode 'scope=https://api.ai.egain.cloud/auth/core.aiservices.read https://api.ai.egain.cloud/auth/core.aiservices.manage'

Next Steps:

PKCE

On-Behalf-Of