1"use strict";(globalThis.webpackChunkdocs=globalThis.webpackChunkdocs||[]).push([[4621],{24771(e,t,n){n.r(t),n.d(t,{assets:()=>o,contentTitle:()=>a,default:()=>h,frontMatter:()=>s,metadata:()=>i,toc:()=>l});const i=JSON.parse('{"id":"authentication/client-secrets","title":"Client Secrets","description":"A client secret can be used to obtain access tokens, which are required when calling the Stitch API.","source":"@site/docs/authentication/client-secrets.md","sourceDirName":"authentication","slug":"/authentication/client-secrets","permalink":"/authentication/client-secrets","draft":false,"unlisted":false,"tags":[],"version":"current","sidebarPosition":5,"frontMatter":{"sidebar_position":5,"sidebar_label":"Client Secrets","title":"Client Secrets"},"sidebar":"defaultSidebar","previous":{"title":"User Tokens","permalink":"/authentication/user-tokens"},"next":{"title":"Client Token Lifetimes","permalink":"/authentication/token-lifetimes"}}');var c=n(58925),r=n(78178);const s={sidebar_position:5,sidebar_label:"Client Secrets",title:"Client Secrets"},a=void 0,o={},l=[{value:"Obtaining a Client Token",id:"obtaining-a-client-token",level:3},{value:"Obtaining a User Token",id:"obtaining-a-user-token",level:3}];function d(e){const t={a:"a",admonition:"admonition",code:"code",h3:"h3",p:"p",pre:"pre",...(0,r.R)(),...e.components};return(0,c.jsxs)(c.Fragment,{children:[(0,c.jsxs)(t.p,{children:["A client secret can be used to obtain ",(0,c.jsx)(t.a,{href:"/authentication/introduction",children:"access tokens"}),", which are required when calling the Stitch API."]}),"\n",(0,c.jsxs)(t.p,{children:["The client secret will be used through a method known as a ",(0,c.jsx)(t.code,{children:"client_secret_post"}),", as described in Section 9 of ",(0,c.jsx)(t.a,{href:"https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication",children:"OpenID Connect Core 1.0"}),"."]}),"\n",(0,c.jsxs)(t.p,{children:["To follow the steps in this section, please ensure that you have received a ",(0,c.jsx)(t.code,{children:"client_id"}),", and a ",(0,c.jsx)(t.code,{children:"client_secret"}),"."]}),"\n",(0,c.jsxs)(t.p,{children:["If you currently have a certificate and need help switching to secret-based authentication, please reach out to a Stitch\nengineer via our ",(0,c.jsx)(t.a,{href:"https://support.stitch.money/hc/en-us/requests/new",children:"Support Form"}),"."]}),"\n",(0,c.jsx)(t.admonition,{title:"Expiry Period",type:"info",children:(0,c.jsx)(t.p,{children:"Your secret has a 2-year expiry period. Please contact Stitch before the expiry date to request a new secret"})}),"\n",(0,c.jsx)(t.h3,{id:"obtaining-a-client-token",children:"Obtaining a Client Token"}),"\n",(0,c.jsx)(t.p,{children:"This example uses cURL to retrieve the client access token."}),"\n",(0,c.jsxs)(t.p,{children:["You'll need to replace the ",(0,c.jsx)(t.code,{children:"CLIENT_ID"}),", ",(0,c.jsx)(t.code,{children:"CLIENT_SECRET"}),", and the ",(0,c.jsx)(t.code,{children:"scope"})," with your appropriate values. If correctly formed,\nthis request will return a JSON payload with the token."]}),"\n",(0,c.jsx)(t.pre,{children:(0,c.jsx)(t.code,{className:"language-bash",children:"curl --location --request POST 'https://secure.stitch.money/connect/token' \\\n--header 'Content-Type: application/x-www-form-urlencoded' \\\n--data-urlencode 'grant_type=client_credentials' \\\n--data-urlencode 'client_id=*CLIENT_ID*' \\\n--data-urlencode 'scope=client_paymentrequest' \\\n--data-urlencode 'client_secret=*CLIENT_SECRET*'\n"})}),"\n",(0,c.jsx)(t.h3,{id:"obtaining-a-user-token",children:"Obtaining a User Token"}),"\n",(0,c.jsx)(t.p,{children:"This example uses cURL to retrieve the user access and refresh token."}),"\n",(0,c.jsxs)(t.p,{children:["You'll need to replace the ",(0,c.jsx)(t.code,{children:"CLIENT_ID"}),", ",(0,c.jsx)(t.code,{children:"REDIRECT_URI"}),", ",(0,c.jsx)(t.code,{children:"AUTH_CODE"}),", ",(0,c.jsx)(t.code,{children:"CODE_VERIFIER"})," and ",(0,c.jsx)(t.code,{children:"CLIENT_SECRET"})," with the\nappropriate values. If correctly formed, this request will return a JSON payload with the tokens."]}),"\n",(0,c.jsx)(t.pre,{children:(0,c.jsx)(t.code,{className:"language-bash",children:"curl --location --request POST 'https://secure.stitch.money/connect/token' \\\n --header 'Content-Type: application/x-www-form-urlencoded' \\\n --data-urlencode 'client_id=*CLIENT_ID*' \\\n --data-urlencode 'redirect_uri=*REDIRECT_URI*' \\\n --data-urlencode 'grant_type=authorization_code' \\\n --data-urlencode 'code=*AUTH_CODE*' \\\n --data-urlencode 'code_verifier=*CODE_VERIFIER*' \\\n --data-urlencode 'client_secret=*CLIENT_SECRET*'\n"})})]})}function h(e={}){const{wrapper:t}={...(0,r.R)(),...e.components};return t?(0,c.jsx)(t,{...e,children:(0,c.jsx)(d,{...e})}):d(e)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.