OAuth 2.0 is the appropriate authentication method when third-party applications need delegated access on behalf of a resource owner, or when client credentials-based machine-to-machine access is required.

Supported Grant Types #

Note: PKCE (Proof Key for Code Exchange) is required for the Authorization Code flow. Only code_challenge_method: S256 is supported.

Registering an OAuth Client #

Before using OAuth, register your application:

1. Navigate to DDLS > Developer > OAuth Clients.
2. Click Add New Client.
3. Provide the application name and redirect URI(s).
4. Save. You will receive a client_id and client_secret.

Token Lifetimes #

OAuth Endpoints #

Authorization Code Flow (with PKCE) #

1. Generate a code_verifier (random string, 43-128 chars) and derive code_challenge = BASE64URL(SHA256(code_verifier)).
2. Redirect the user to the authorization endpoint:

GET /wp-json/dmsi-api/v1/oauth/authorize
  ?response_type=code
  &client_id=<your-client-id>
  &redirect_uri=<your-redirect-uri>
  &scope=licenses:read
  &state=<random-state>
  &code_challenge=<code-challenge>
  &code_challenge_method=S256

1. After user consent, the authorization server redirects to your redirect_uri with a code parameter.
2. Exchange the code for tokens:

curl -X POST https://yoursite.com/wp-json/dmsi-api/v1/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code" \
  -d "code=<authorization-code>" \
  -d "redirect_uri=<your-redirect-uri>" \
  -d "client_id=<your-client-id>" \
  -d "code_verifier=<code-verifier>"

Client Credentials Flow #

curl -X POST https://yoursite.com/wp-json/dmsi-api/v1/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -u "<client-id>:<client-secret>" \
  -d "grant_type=client_credentials" \
  -d "scope=licenses:read products:read"