You're viewing **Apigee Edge** documentation. [Go to the **Apigee X** documentation](http://cloud.google.com/apigee/docs/api-platform/security/oauth/working-scopes). info Welcome to the home page for OAuth on Apigee Edge. This landing page provides links to documentation, samples, and other resources related to using OAuth on Apigee Edge. ## The OAuth 2.0 framework Secure your APIs with OAuth 2.0. This section lists resources, sample code, videos, and other topics to help you be successful using OAuth 2.0 on Apigee Edge! > [!NOTE] > **Note:** Apigee recommends choosing the OAuth 2.0 framework rather than OAuth 1.0a whenever possible. ### Learn about OAuth 2.0 This collection of resources will help you get up to speed on OAuth 2.0. - **Apigee documentation:** - [Introduction to OAuth 2.0](https://docs.apigee.com/api-platform/security/oauth/oauth-introduction) -- Covers basic OAuth 2.0 concepts and terms. Focuses using OAuth on Apigee Edge. - **Apigee training and certifications:** - Apigee offers online training for API developers, including a course on [API security](https://www.coursera.org/learn/api-security-apigee-gcp), which includes OAuth. - **IETF Specification:** - [IETF Specification](https://tools.ietf.org/html/draft-ietf-oauth-v2-31) -- Apigee highly recommends that you review this specification. It includes a good basic introduction and conceptual overview. - **Apigee e-book and video:** - [OAuth the Big Picture](https://pages.apigee.com/ebook-oauth-the-big-picture-reg.html?int_source=resources-main&int_medium=website&int_campaign=ebook&int_content=oauth-big-picture), a free Apigee e-book. - [OAuth the Big Picture](https://apigee.com/about/resources/webcasts/oauth-big-picture), a free Apigee webcast. *** ** * ** *** ### Implement the grant type flows Apigee provides working samples of each OAuth 2.0 grant type to help you get started. The samples represent best practices and demonstrate how to implement OAuth grant types on Apigee Edge. #### Client credentials - [Implementing the client credentials grant type](https://docs.apigee.com/api-platform/security/oauth/oauth-20-client-credentials-grant-type) - Introduces the grant type, with an emphasis on the steps you need to follow to implement this grant type on Apigee Edge. - [Sample implementation](https://github.com/apigee/api-platform-samples/tree/master/sample-proxies/oauth-client-credentials) -- Check out this sample on our api-samples repo on GitHub. - [API security](https://www.coursera.org/learn/api-security-apigee-gcp) (includes OAuth) #### Authorization code - [Implementing the authorization code grant type](https://docs.apigee.com/api-platform/security/oauth/oauth-v2-policy-authorization-code-grant-type) -- Introduces the grant type, with an emphasis on the steps you need to follow to implement this grant type on Apigee Edge. - [Sample implementation](https://github.com/apigee/api-platform-samples/tree/master/sample-proxies/oauth-advanced) -- Check out this advanced sample on our api-samples repo on GitHub. You can clone the sample, deploy it, and run it. For details, see the [README](https://github.com/apigee/api-platform-samples/tree/master/sample-proxies/oauth-advanced/README.md) file. It includes a robust login app that authenticates users and communicates securely with the authorization server. #### Implicit - [Requesting tokens: Implicit grant type](https://docs.apigee.com/api-platform/security/oauth/access-tokens#requestinganaccesstokenimplicitgranttype) -- Shows how to request tokens with the implicit grant type. #### Resource owner password credentials - [Implementing the password grant type](https://docs.apigee.com/api-platform/security/oauth/implementing-password-grant-type) -- Introduces the grant type, with an emphasis on the steps you need to follow to implement this grant type on Apigee Edge. *** ** * ** *** ### Quick how-to topics These topics give you quick context and concise steps for handling common OAuth 2.0 tasks: - [Configuring a new API proxy](https://docs.apigee.com/api-platform/security/oauth/understanding-default-oauth-20-configuration) - [Registering client apps](https://docs.apigee.com/api-platform/security/registering-client-apps) - [Obtaining client credentials](https://docs.apigee.com/api-platform/security/oauth/obtaining-developer-keys) - [Configuring OAuth endpoints and policies](https://docs.apigee.com/api-platform/security/oauth/configuring-oauth-endpoints-and-policies) - [Requesting tokens and auth codes](https://docs.apigee.com/api-platform/security/oauth/access-tokens) - [Customizing access tokens](https://docs.apigee.com/api-platform/security/oauth/customizing-access-tokens) - [Approving and revoking access tokens](https://docs.apigee.com/api-platform/security/oauth/validating-and-invalidating-access-tokens) - [Sending an access token](https://docs.apigee.com/api-platform/security/oauth/sending-access-token) - [Verifying access tokens](https://docs.apigee.com/api-platform/security/oauth/using-access-tokens) - [Working with scopes](https://docs.apigee.com/api-platform/security/oauth/working-scopes) - [Advanced topics](https://docs.apigee.com/api-platform/security/oauth/advanced-oauth-20-topics) ### Policy and API references These topics provide detailed reference information on the policies and APIs that directly support OAuth 2.0 on Edge. - **OAuthV2 Policies** -- These policies allow you to implement and customize the four OAuth 2.0 grant types on Apigee Edge: - [OAuthV2 policy](https://docs.apigee.com/api-platform/reference/policies/oauthv2-policy) -- The heart of the Apigee Edge OAuth 2.0 implementation. It lets you configure OAuth 2.0 "operations" on Apigee Edge that generate access and refresh tokens, issue authorization codes, and validate tokens. This topic includes code samples to help illustrate how things work. - [GetOAuthV2Info policy](https://docs.apigee.com/api-platform/reference/policies/get-oauth-v2-info-policy) -- Gets attributes of tokens and makes them available to policies and code executing in an API proxy. This policy type can be useful when you need to configure dynamic, conditional behavior based on a value in an access token. See also [Customizing access tokens](https://docs.apigee.com/api-platform/security/oauth/customizing-access-tokens). - [SetOAuthV2Info policy](https://docs.apigee.com/api-platform/reference/policies/set-oauth-v2-info-policy) -- Updates the profile of an access token. For example, you may want to embed a tag that is unique to you business. See also [Customizing access tokens](https://docs.apigee.com/api-platform/security/oauth/customizing-access-tokens). - **OAuth 2.0 error codes** - [OAuth HTTP error response reference](https://docs.apigee.com/api-platform/reference/policies/oauth-http-status-code-reference) - **OAuth 2.0 APIs** -- Apigee provides these APIs for working with OAuth 2.0 endpoints. - [OAuth 2.0 Access tokens](https://apidocs.apigee.com/docs/oauth-20-access-tokens/1/overview) - [OAuth 2.0 Request tokens](https://docs.apigee.com/api/oauth-20-authorization-code) - [OAuth 2.0 Refresh tokens](https://docs.apigee.com/api/oauth-20-refresh-tokens) *** ** * ** *** ## The OAuth 1.0a framework OAuth 1.0a defines a standard protocol that enables app users to authorize apps to consume APIs on their behalf, without requiring app users to disclose their passwords to the app in the process. > [!NOTE] > **Note:** Apigee recommends choosing the OAuth 2.0 framework rather than OAuth 1.0a whenever possible. ### OAuth 1.0a policy reference Support for OAuth 1.0a is deprecated. For details, see [Deprecated features](https://docs.apigee.com/release/deprecated-features#deprecations). The OAuthV1 policy type is responsible for generating request tokens, generating access tokens, and verifying access tokens based on the OAuth 1.0a specification. ### OAuth 1.0a APIs Apigee provides APIs for working with OAuth 1.0a endpoints. - [OAuth 1.0a Access tokens](https://docs.apigee.com/api/oauth-10a-access-tokens) - [OAuth 1.0a Request tokens](https://docs.apigee.com/api/api_resources/31-oauth-1-0a-request-tokens) - [OAuth 1.0a Verifiers](https://docs.apigee.com/api/oauth-10a-verifiers) ### OAuth 1.0a sample on GitHub This [sample API proxy on GitHub](https://github.com/apigee/api-platform-samples) illustrates an OAuth 1.0a three-legged configuration. You can download and run this code. | Name | Description | |---|---| | [oauth10a-3legged](https://github.com/apigee/api-platform-samples/tree/master/sample-proxies/oauth10a-3legged) | Demonstrates an OAuth 1.0a three-legged configuration. |