Introduction

OAuth2 stands for "Open Authorization 2.0". It is the second version of the OAuth protocol, which is an open standard for access delegation commonly used for API authentication and authorization. OAuth 2.0 is a widely used authorization framework that allows applications to securely access resources on behalf of users without needing their credentials. It's commonly used for API authentication in web and mobile applications. OAuth 2.0 uses Access Tokens, an Access Token is a piece of data that represents the authorization to access resources on behalf of the end-user.

How It Works:

The API OAuth2 Authentication module for Odoo integrates the OAuth2 authorization coupled with api framework, ensuring secure API access with the authorization-code-grant flow of the specification. It provides seamless management of client authentication and token lifecycle, making it an essential component of the API bundle. This module enhances the security and functionality of your Odoo API integrations.

Authorization and Token Related Steps:

• First, client register redirect-uri, which is provided in api record form, to its respected provider.
• Client has to made request to "/<api>/oauth2/provider/authorize" with its client_id in request-body(json), which returns authorization_url in json-body from response.
• When client use this authorization_url, client has to authorize with its respected user, after successful authorization server returns token information.
  Which includes:
• access_token, refresh_token, expires_in, expires_at, scope, token_type, id_token. Note: This differs from provider to provider.
• db, login
• If client wants to refresh the token & get access-token then made request to "/<api>/oauth2/token" with its client-id, client-user-identity in request-body(json), which returns new token related information.
• If client wants to revoke the token then made request to "/<api>/oauth2/revoke" with its client-id, client-user-identity in request-body(json), which revoke the token from authorization server and also delete the client api user record.

API Resource Access Steps:

• When client want fetch api data using oauth2 method, made http-request using header: Authorization: Bearer access_token_value
• If access_token is valid then it return response data and if access_token is invalid then client has to refresh the token or authorize the user again.

Python Request Examples:

1. Client Authorization:

import requests
import json

url = "https://easyapi.ekika.app/jsonapiext/oauth2/provider/authorize"

payload = json.dumps({
  "client_id": "YOUR_CLIENT_ID",
  "client_user_identity": "YOUR_UNIQUE_CLIENT_IDENTITY"
})
headers = {
  'Content-Type': 'application/json'
}

response = requests.request("GET", url, headers=headers, data=payload)

print(response.text)

2. Refresh Token:

import requests
import json

url = "https://easyapi.ekika.app/jsonapiext/oauth2/token"

payload = json.dumps({
  "client_id": "YOUR_CLIENT_ID",
  "client_user_identity": "YOUR_UNIQUE_CLIENT_IDENTITY"
})
headers = {
  'Content-Type': 'application/json'
}

response = requests.request("POST", url, headers=headers, data=payload)

print(response.text)

3. Revoke Token:

import requests
import json

url = "https://easyapi.ekika.app/jsonapiext/oauth2/revoke"

payload = json.dumps({
  "client_id": "YOUR_CLIENT_ID",
  "client_user_identity": "YOUR_UNIQUE_CLIENT_IDENTITY"
})
headers = {
  'Content-Type': 'application/json'
}

response = requests.request("GET", url, headers=headers, data=payload)

print(response.text)

Configuring API OAuth2 Authentication