OAuth2 - Authorization Code

OAuth 2.0 Authorization Code Workflow for Brightlever Integration This guide outlines the steps to integrate your application with Brightlever's APIs using the OAuth 2.0 authorization code grant type.

1. Register Your Application

Log in to the Brightlever and go to your environment admin. Create a new application and provide the following information: Application Name: A descriptive name for your application. Redirect URI: The URI your application will redirect to after the user grants authorization (e.g., https://your-app.com/callback). Upon successful registration, you'll receive a Client ID and Client Secret. Keep these confidential.

2. Initiate the Authorization Request

Construct the authorization request URL:

https://brightlever.app/oauth/authorize?response_type=code&client_id=YOUR_CLIENT_ID&redirect_uri=YOUR_ENCODED_REDIRECT_URI&scope=cms:read%20cms:write

response_type: Must be code for the authorization code grant.

client_id: Your application's Client ID.

redirect_uri: Your application's encoded callback URI.

scope: (Optional) A space-delimited list of permissions your application requires. The available scopes are: cms:read: Grants read-only access to content. cms:write: Grants read and write access to content.

state: (Recommended) A random string to prevent cross-site request forgery (CSRF) attacks.

3. User Authorization

Brightlever will prompt the user to log in (if not already) and review the requested permissions. If the user approves, Brightlever will redirect them back to your redirect_uri with a temporary code and the state parameter in the query string.

4. Exchange Code for Access Token

Make a POST request to the Brightlever token endpoint:

Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&code=AUTHORIZATION_CODE_FROM_STEP_3
&redirect_uri=YOUR_ENCODED_REDIRECT_URI
&client_id=YOUR_CLIENT_ID
&client_secret=YOUR_CLIENT_SECRET

Brightlever will respond with:

{
  "access_token": "ACCESS_TOKEN",
  "token_type": "bearer",
  "refresh_token": "REFRESH_TOKEN" 
}

Use code with caution.

access_token: Use this token in subsequent API requests to Brightlever.
refresh_token: (If requested) Used to obtain a new access token when the current one expires.

5. Use the Access Token

Include the access_token in the Authorization header of your API requests to Brightlever:

Authorization: Bearer ACCESS_TOKEN

6. Refresh the Access Token (Optional)

If you received a refresh_token, make a POST request to the token endpoint with grant_type=refresh_token to obtain a new access_token before it expires.

OAuth2 - Implicit Grant