Skip to content
Lobo OneDeveloper platform

Authentication

An application authenticates with the OAuth 2.0 client credentials grant against Lobo One’s identity provider, and presents the resulting access token as a bearer token. There is no API key, and no credential Lobo One issues itself.

Your credential

Registering an application returns a client identifier and a client secret. The secret is shown once and is stored nowhere in Lobo One — there is no endpoint that returns it again, because there is nothing to return it from. If you lose it, rotate it, which issues a new one and stops the old one working immediately.

Getting a token

shellthe token request
curl -X POST "$ISSUER/protocol/openid-connect/token" \
  -d grant_type=client_credentials \
  -d client_id=app-0123456789abcdef \
  -d client_secret=$CLIENT_SECRET

$ISSUER is the realm address of the installation you are integrating with. The token it returns names this API in its audience; a token minted for anything else is refused.

Making a call

Two headers on every request. The bearer token says which application is calling. The context header says which club it is acting in, and must be a club that granted you.

shella call in a club’s context
curl "$API/v1/tenants/$CLUB/members?limit=20" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "X-Lobo-Context-Id: $CLUB"

What the token does not do

  • It does not carry your permissions. What you may do is the grant the club wrote, looked up on every request. A token cannot widen it.
  • It does not act as a person. An application has no identity in Lobo One, holds no role anywhere, and the endpoints that describe a caller to themselves refuse it.
  • It does not survive suspension. If your application is suspended, the identity provider stops issuing tokens for it and this API refuses the one you already hold.

Scopes on the token

You may request a subset of what a club granted by setting scope on the token request — useful for a component that should only be able to read. It can only narrow: a scope the club did not grant contributes nothing. Requesting no scope means everything you were granted.