Get an access token

There are following steps required to obtain access token:

• Redirect users to:

  https://api.wordwatch.com/oauth/authorize
  ?response_type=code
  &client_id=YOUR_APPLICATION_ID
  &redirect_uri=YOUR_REGISTERED_REDIRECT_URI

  Example:

  https://api.wordwatch.com/oauth/authorize
  ?response_type=code
  &client_id=ad46761032adb2d5e05244c4b34c52b110a113503b7caa8ba904c848e5d3818
  &redirect_uri=http%3A%2F%2Ftest.host%2Fusers%2Fauth%2Fdoorkeeper%2Fcallback

• Once users accepts, he will be redirected to:

  https://YOUR_REGISTERED_REDIRECT_URI/?code=CODE

  Example:

  http://test.app.com/users/auth/doorkeeper/callback
  ?code=30184b7ef03bfe0c7acd2f5a54296a57a86cb86b8731a79de35e2240ce170e11

• In case if user denies, he will be redirected to:

  https://YOUR_REGISTERED_REDIRECT_URI/?error=access_denied

  Example:

  http://test.app.com/users/auth/doorkeeper/callback?error=access_denied

• Your server will make a POST request for:

  https://api.wordwatch.com/oauth/token
  parameters:
  {client_id=YOUR_CLIENT_ID
  &client_secret=YOUR_CLIENT_SECRET
  &grant_type=authorization_code
  &redirect_uri=YOUR_REGISTERED_REDIRECT_URI
  &code=CODE}

  Example:

  https://api.wordwatch.com/oauth/token
  {“grant_type”=>”authorization_code”,     ”code”=>”30184b7ef03bfe0c7acd2f5a54296a57a86cb86b8731a79de35e2240ce170e11″,     ”client_id”=>”ad46761032adb2dd5e05244c4b34c52b110a1135aa8ba904c848e5d3818″,     ”client_secret”=>”885e8e5272b12b88c887907abd7e831ee6f1cae575b117df231bda9d”,
  “redirect_uri”=>”http://test.app.com/users/auth/doorkeeper/callback”}

• The response will be JSON:

  { access_token: ACCESS_TOKEN }

  Example:

  {“access_token”:”c8936419310707903f141dd3d1abba8fcf482ec2bf764b0016″,
  “token_type”:”bearer”,
  “expires_in”:3600,
  “refresh_token”:”236b918ce8addc6c9de8a6ceasdasdf04feaf1767a1f812dc960″}

  Notes:

  access_token – the access token issued by the authorization server.
  token_type – the type of the token issued. The “bearer” token type is utilized by simply including the access token string in the request
  expires_in – the lifetime in seconds of the access token.
  refresh_token – the refresh token which can be used to obtain new access tokens using the same authorization grant

• You will want to reuse ACCESS_TOKEN for  the calls you are about to execute

  Once you have an access token. All you have to do in order to to use any of the endpoints is adding access_token=ACCESS_TOKEN to your request.

  curl -L ‘http://test.host:3444/api/v1/user.json?access_token=c8936419310707903f14a42789dabf87fcf482ec2bf764b0016a’

  {“id”:18,
  “name”:”Test Name”,
  “company”:”Dummy Company”,
  “phone”:”44 79934993499″,
  “email”:”test@dummy.com”,
  “newsletter”:0}

• Wrong access token usage will generate 401 Unauthorized error

  status: 401 Unauthorized