Authentication
Authentication
The Riversoft STCP DirectLink API authenticates users through local login, OAuth tokens, or a corporate identity provider. The method available to each user depends on the environment configuration; check with the service administrator which method is authorized for your integration.
Choose the method
| Need | Method | Guide |
|---|---|---|
| Reproduce the user login, with MFA | Local login (HTTP Basic) | Local login and MFA |
| Integrate systems with user and password | Password grant (may be disabled; not part of OAuth 2.1) | OAuth tokens |
| Reuse a JWT issued by another system | Token exchange | OAuth tokens |
| Use a long-lived technical credential | Impersonation token | OAuth tokens |
| Sign in through the corporate provider in the browser | SSO (OAuth 2.0 and 2.1/OpenID Connect or SAML 2.0) | Single Sign-On |
Note
/auth/login and the token endpoints (/auth/token and /oauth2/token) have different contracts. Login uses HTTP Basic and returns a session cookie; the token endpoints accept an OAuth 2.0 form and return a Bearer token in the JSON.
In this section
Authenticate the user with HTTP Basic at /auth/login and complete the second factor when required.
Get a Bearer token through the password grant or exchange a source JWT for an API token (token exchange).
Federated login and logout in the browser with OAuth 2.0 and 2.1/OpenID Connect and SAML 2.0.
Send the session credential on protected routes, handle expiration, and end the session.
Start the first access or password recovery and set the new password through the secure link.