Authentication
Introduction
Centrix is secured with an OpenID Connect implementation with the OAuth 2.0 authorization protocol. All API requests require a valid Access Token, which is retrieved from the OIDC Auth server.
The auth server URL is:
https://auth.centrix.world/oidc
https://auth.centrix.world/oidc/.well-known/openid-configuration
Please contact an authorized reseller for creation of access credentials. Client Credentials (Client ID,
Client Secret, and API Key) will be provided by the reseller after generation.
Your Client Secret should be stored in a secure location and in an encrypted format.
Your Client Secret should not be shared with any other parties, integrations, applications. Nor should it be used for multiple
integrations or applications.
If you require an additional set of ClientCredentials for a new integration or application, please contact your authorized reseller.
Any data loss, security breaches, or unauthorized access to the Centrix API due to the sharing or misuse of your Client Secret will be the
responsibility of the party that shared or made the Client Secret publicly available.
Supported Authentication Flows
Authorization Code (w/ PKCE)
The OAuth Authorization Code flow is used when authenticating using user login credentials and a server-side application via a browser. The user is prompted to login to the auth server via your application. The Auth server will provide an Authorization Code, which can be exchanged for an Access Token.
A refresh token can also be requested with the offline_access scope, if the user has granted it.
Implementing applications must provide atleast 1 redirect URI for the creation of the OIDC client credentials, and a valid redirect URI must be provided during the OAuth flow. A list of allowed cross-origin domains may also be provided for browser-based applications.
Client Credentials
Client Credentials is a flow for machine-to-machine authentication. The Client ID, Client Secret, and API Key can be exchanged
directly for an access token, without user intervention.
Access Permissions
Access permissions in the API are determined by the role/s assigned to the user (when using Authorization Code flow), or role/s assigned to the OIDC Client (when using Client Credentials flow).
Typically a bespoke role is created for the integration, which will heavily limit the possible operations to those requested. Additional permissions may be requested from your authorized reseller at the time of credentials generation, and can be updated at any point after generation, as required.
Requests
All secured requests require the Authorization header, containing a bearer access token from one of the authentication flows:
Authorization: Bearer ...
Unauthenticated requests, or requests with an invalid token, will yield a 401 error with an appropriate error message. See Error Responses for more info.
Each set of OIDC credentials can only be linked to one application at a time, and requests to the API using a set of OIDC credentials will only be possible to the linked application. If the user has access to multiple applications, multiple OIDC credentials will be necessary.