OAuth2 - Implicit Grant

OAuth 2.0 Implicit Grant Workflow for Brightlever Integration This guide outlines the steps to integrate your application with Brightlever's APIs using the OAuth 2.0 Implicit Grant type. Note: The Implicit Grant is less secure than the Authorization Code Grant and is generally recommended only for specific scenarios (e.g., browser-based applications where a backend server is not involved).

1. Register Your Application

Log in to the Brightlever and go to your environment admin. Create a new application and provide the following information: Application Name: A descriptive name for your application. Redirect URI: The URI your application will redirect to after the user grants authorization (e.g., https://your-app.com/callback). Upon successful registration, you'll receive a Client ID. Keep this confidential.

2. Initiate the Authorization Request

Construct the authorization request URL:

https://brightlever.app/oauth/authorize?response_type=token&client_id=YOUR_CLIENT_ID&redirect_uri=YOUR_ENCODED_REDIRECT_URI&scope=cms:read%20cms:write

response_type: Must be token for the Implicit Grant.

client_id: Your application's Client ID.

redirect_uri: Your application's encoded callback URI.

scope: (Optional) A space-delimited list of permissions your application requires. The available scopes are: cms:read: Grants read-only access to content. cms:write: Grants read and write access to content. Redirect the user to this URL.

state: (Recommended) A random string to prevent cross-site request forgery (CSRF) attacks.

3. User Authorization and Token Retrieval

Brightlever will prompt the user to log in (if not already) and review the requested permissions. If the user approves, Brightlever will redirect them back to your redirect_uri. The access token will be included in the URL fragment (#) of the redirect URI, along with the state parameter. Example redirect URI:

https://your-app.com/callback#access_token=ACCESS_TOKEN&token_type=bearer&expires_in=3600&state=YOUR_RANDOM_STATE_STRING

4. Use the Access Token

Extract the access_token from the URL fragment and include it in the Authorization header of your API requests to Brightlever:

Authorization: Bearer ACCESS_TOKEN

Important Considerations

The Implicit Grant is less secure than the Authorization Code Grant, as the access token is exposed in the URL. Consider using the Authorization Code Grant if your application has a backend server component. Implement appropriate security measures to protect the access token in your client-side application.