31 docs tagged with "jwt-token"

Authorize service-to-service and partner API access with Access Pass Personal Access Tokens (PAT) instead of JWTs.

cidaas is an OAuth 2.0 and OpenID Connect authorization server — authorization server basics, standard grants, tokens, and how to secure your apps.

AuthZEN permission management in cidaas — policy-based authorization, evaluation, and fine-grained access control.

Step-by-step AuthZEN search — catalog setup, filter vs evaluation policies, SearchConfig, live search APIs, post-evaluation, and troubleshooting.

Live vs simulation AuthZEN channels — version pins, simulation evaluation and search, cache, explain, and a safe rollout path.

Claim consent in cidaas — let users authorise the release of identity claims such as name, email or roles to an application before a token is issued.

Integrate cidaas login in your application

The Client Credentials Grant is a type of OAuth 2.0 flow that allows a client application to request access tokens directly from an authorization server by using its own credentials. This flow is specifically designed for Machine-to-Machine (M2M) authentication scenarios where no user interaction is required.

This flow can be reimplemented and integrated into their own pages and platform directly using the cidaas APIs

The Device Code Flow (officially: OAuth 2.0 Device Authorization Grant) is an OAuth 2.0 grant type designed for devices that don't have a browser or have limited input capabilities, such as smart TVs, gaming consoles, CLI tools, or IoT devices. It enables users to authorize these devices to access their resources by authenticating on a separate device (e.g., smartphone or computer) with a full browser.

When a user logs out of your application, you need to properly end their session with cidaas to ensure they're logged out from all applications using the same cidaas instance. This guide explains how to implement logout using OpenID Connect specifications.

Authenticate with FIDO2 in cidaas — let users sign in with FIDO2 compliant Keys, or via passkeys or platform authenticators.

Group selection in cidaas — let users pick the group or context they log in with, enforce the selection, or auto-select one using the group_hint parameter.

Group Role Restriction in cidaas — control who can log in by verifying group membership and roles, embed hints in the JWT, and validate access at runtime.

CIBA (Client-Initiated Backchannel Authentication), also known as Transactional Authentication, is a modern OAuth 2.0 authentication flow that enables secure, device-to-device authentication. It allows users to authenticate on one device (like their mobile phone) while logging into an application on a completely different device (like a Smart TV, kiosk, or terminal).

Integrating cidaas with your business is simple and can be done for the Admin and User Service portals.

cidaas supports OAuth2 and OpenID Connect (OIDC) for Single Sign-On (SSO) authentication. You can configure cidaas to act as an Identity Provider (IdP) or as a Service Provider (SP).

Authenticate with a pattern in cidaas — the user traces a pattern that is verified as a passwordless factor, with the flow and APIs.

Permission management in cidaas — scopes, roles, groups, group/role restrictions, AuthZEN, and group selection, configured in Trustdesk.

Scope consent in cidaas — pause the authentication flow to obtain explicit user authorization for scopes such as email or profile.

Learn how scopes work in OAuth2/OIDC and how to configure and manage scopes and scope groups in cidaas.

Session management lets users stay signed in across applications and devices. This guide explains how sessions relate to OAuth 2.0 and OpenID Connect in cidaas, and points you to the right flows for validation, logout, and native-to-web handoff.

Native applications (for example mobile apps) often open company-owned web applications in the system browser: centralized profiles, webshops, help portals, and similar. Those sites typically expect an active IdP session in the browser—the same kind of session that powers Single Sign-On (SSO) for pure web apps—not only a token inside the native app.

Authenticate with Smart Push in cidaas — the user picks the matching number from four shown in the mobile app to confirm the login.

Integrating Social Login in cidaas

Besides performing a successful authentication, cidaas provides features to apply further conditions that must be fulfilled before issuing a token to the caller.

The OAuth 2.0 Token Exchange (RFC 8693) is a standardized flow that allows a client to exchange one token for another. This is distinct from the standard OAuth authorization code or client credentials flows and is particularly useful in microservices architectures, token delegation scenarios, and when you need to transform tokens for different contexts.

Authenticate with TOTP in cidaas — verify the time-based one-time password from an authenticator app as a passwordless or MFA factor.

Authenticate with Touch ID in cidaas — use the phone's device biometrics as a passwordless or MFA factor, with the flow and APIs.

Validate cidaas tokens — check authenticity, expiry and audience of access, ID and refresh tokens, with a practical validation checklist.

After an authentication, cidaas approves the correctness of provided information with a token. OAuth2 and OpenID Connect work with different tokens. Either way, cidaas will provide an access token based on OAuth2 standard. The token is built up as a JWT (JSON Web Token), which is essentially a base64-encoded JSON format. Optionally, in a user authentication, cidaas can also provide an ID token, which is based on OIDC standard and also built up as a JWT.