ECOMM API Security

Our platform uses OpenID Connect as the security layer for all of our services. In order to use our API you first need to get your application authenticated using the Client Credentials Grant. To get the token you need 5 pieces of information:

• The token endpoint
• clientId
• clientSecret
• scope
• the grant_type

This information varies depending on the environment you are targeting, except for the scope and grant_type.

The token endpoints are:

• Test / Staging “https://flexengage-idp-test.auth.us-east-1.amazoncognito.com/oauth2/token”
• Production “https://flexengage-idp-prod.auth.us-east-1.amazoncognito.com/oauth2/token”

We will provide the clientId and clientSecret to you during the onboarding process. Please reach out to your flexEngage Customer Support Contact (support@flexengage.com) if you have not received one.

The scopes are:

• To create order events is always “flexengage.gateway/order.events.create”

The grant is “client_secret”

Here is an example of how to get an access token:

curl --location --request POST '{TOKEN_ENDPOINT}' \
--header 'Accept: application/json' \
--header 'Authorization: Basic Base64({CLIENT_ID}:{CLIENT_SECRET})' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'client_id={CLIENT_ID}' \
--data-urlencode 'scope=flexengage.gateway/order.events.create'

Once you get the access token you can call our API using the Bearer scheme by sending the “Authorization: Bearer {ACCESS_TOKEN}” header in the request.