Authentication

Obtain an access token with the OAuth 2.0 authorization code flow

The AgriBus API uses the OAuth 2.0 authorization code flow (with OpenID Connect support). Access tokens are JWTs and are sent in the Authorization: Bearer header.

See the auth service reference for endpoint details.

1. Authorization request

Send the user’s browser to the authorization endpoint. Put the required scopes in scope, separated by spaces. PKCE (code_challenge / code_challenge_method=S256) is recommended.

https://auth.agribus-connect.net/v1/oauth/authorize
  ?response_type=code
  &client_id=<client_id>
  &redirect_uri=<redirect_uri>
  &scope=openid%20noki.devices.read%20noki.locations.read
  &state=<random>

After the user signs in with their AgriBus account and approves, the browser returns to the registered redirect_uri with code and state.

2. Exchange the code for tokens

Post the authorization code to the token endpoint (application/x-www-form-urlencoded).

curl -X POST 'https://auth.agribus-connect.net/token' \
  -d 'grant_type=authorization_code' \
  -d 'code=<code>' \
  -d 'redirect_uri=<redirect_uri>' \
  -d 'client_id=<client_id>' \
  -d 'client_secret=<client_secret>'

The response is a TokenResponse: accessToken, its expiry accessTokenExpiredAt, and a refreshToken.

3. Refresh

When the access token expires, use grant_type=refresh_token.

curl -X POST 'https://auth.agribus-connect.net/token' \
  -d 'grant_type=refresh_token' \
  -d 'refresh_token=<refresh_token>' \
  -d 'client_id=<client_id>' \
  -d 'client_secret=<client_secret>'

4. Call the API

curl 'https://datastore.agribus-connect.net/v1/agricultural-machinery/devices' \
  -H 'Authorization: Bearer <accessToken>'

Missing or invalid token: 401
Token lacks a required scope: 403

OpenID Connect

Include openid in scope to receive an ID token. User claims are available from /v1/oidc/userinfo and the signing keys from /.well-known/jwks.json.