diff --git a/src/pages/guides/authentication/JWT/index.md b/src/pages/guides/authentication/JWT/index.md index 68d76a28..95abba38 100644 --- a/src/pages/guides/authentication/JWT/index.md +++ b/src/pages/guides/authentication/JWT/index.md @@ -2,9 +2,9 @@ -The Service Account (JWT) credentials have been deprecated in favor of the OAuth Server-to-Server credentials. Your applications using the Service Account (JWT) credentials will stop working after Jun 30, 2025. You must migrate to the new credential by **Jun 30, 2025**, to ensure your application continues functioning. [Learn more](../ServerToServerAuthentication/migration.md). +The Service Account (JWT) credentials have been deprecated in favor of the OAuth Server-to-Server credentials. Your applications using the Service Account (JWT) credentials will stop working after Jun 30, 2025. You must migrate to the new credential by **Jun 30, 2025**, to ensure your application continues functioning. [Learn more](../ServerToServerAuthentication/migration). -To establish a secure service-to-service Adobe I/O API session, you must create a JSON Web Token (JWT) that encapsulates the identity of your integration, and then exchange it for an access token. Every request to an Adobe service must include the access token in the `Authorization` header, along with the API Key (Client ID) that was generated when you created the [Service Account Integration](../service-account-integration.md) in the [Adobe Developer Console](https://developer.adobe.com/console/). +To establish a secure service-to-service Adobe I/O API session, you must create a JSON Web Token (JWT) that encapsulates the identity of your integration, and then exchange it for an access token. Every request to an Adobe service must include the access token in the `Authorization` header, along with the API Key (Client ID) that was generated when you created the [Service Account Integration](../service-account-integration) in the [Adobe Developer Console](https://developer.adobe.com/console/). ## Authentication Workflow @@ -22,7 +22,7 @@ Your JWT must contain the following claims: | iss | _Required_. The issuer, your **Organization ID** from the Adobe Developer Console integration, in the format `org_ident@AdobeOrg`. Identifies your organization that has been configured for access to the Adobe I/O API.| | sub | _Required_. The subject, your **Technical Account ID** from the Adobe Developer Console integration, in the format: `id@techacct.adobe.com`.| | aud | _Required_. The audience for the token, your **API Key** from the Adobe Developer Console integration, in the format: `https://ims-na1.adobelogin.com/c/api_key`.| -| Metascopes | _Required_. The API-access claim configured for your organization: [JWT Metascopes](scopes.md), in the format: `"https://ims-na1.adobelogin.com/s/meta_scope": true`| +| Metascopes | _Required_. The API-access claim configured for your organization: [JWT Metascopes](scopes), in the format: `"https://ims-na1.adobelogin.com/s/meta_scope": true`| The following is a sample payload to be signed and encoded. @@ -40,7 +40,7 @@ The following is a sample payload to be signed and encoded. The JWT must be signed and base-64 encoded for inclusion in the access request. The JWT libraries provide functions to perform these tasks. -- The token must be signed using the private key for a digital signing certificate that is associated with your API key. You can associate more than one certificate with an API key. If you do so, you can use the private key of any associated certificate to sign your JWT. For more information about private key/public certificate, see [Create a public key certificate](./jwt-certificate.md#using-the-public-key-certificate-for-service-account-integration). +- The token must be signed using the private key for a digital signing certificate that is associated with your API key. You can associate more than one certificate with an API key. If you do so, you can use the private key of any associated certificate to sign your JWT. For more information about private key/public certificate, see [Create a public key certificate](./jwt-certificate#using-the-public-key-certificate-for-service-account-integration). **Algorithm**: **RS256** (RSA Signature with SHA-256) is an asymmetric algorithm, and it uses a public/private key pair: the identity provider has a private (secret) key used to generate the signature, and the consumer of the JWT (i.e. Adobe Developer Console) gets a public key to validate the signature. diff --git a/src/pages/guides/authentication/JWT/jwt-certificate.md b/src/pages/guides/authentication/JWT/jwt-certificate.md index a27c14f5..52d89c1d 100644 --- a/src/pages/guides/authentication/JWT/jwt-certificate.md +++ b/src/pages/guides/authentication/JWT/jwt-certificate.md @@ -2,7 +2,7 @@ -The Service Account (JWT) credentials have been deprecated in favor of the OAuth Server-to-Server credentials. Your applications using the Service Account (JWT) credentials will stop working after Jun 30, 2025. You must migrate to the new credential by **Jun 30, 2025**, to ensure your application continues functioning. [Learn more](../../ServerToServerAuthentication/migration.md). +The Service Account (JWT) credentials have been deprecated in favor of the OAuth Server-to-Server credentials. Your applications using the Service Account (JWT) credentials will stop working after Jun 30, 2025. You must migrate to the new credential by **Jun 30, 2025**, to ensure your application continues functioning. [Learn more](../../ServerToServerAuthentication/migration). Create a private key and a public certificate. Make sure you store these securely. diff --git a/src/pages/guides/authentication/JWT/samples.md b/src/pages/guides/authentication/JWT/samples.md index 4ab15d41..b3fb41bd 100644 --- a/src/pages/guides/authentication/JWT/samples.md +++ b/src/pages/guides/authentication/JWT/samples.md @@ -3,7 +3,7 @@ -The Service Account (JWT) credentials have been deprecated in favor of the OAuth Server-to-Server credentials. Your applications using the Service Account (JWT) credentials will stop working after Jun 30, 2025. You must migrate to the new credential by **Jun 30, 2025**, to ensure your application continues functioning. [Learn more](../../ServerToServerAuthentication/migration.md). +The Service Account (JWT) credentials have been deprecated in favor of the OAuth Server-to-Server credentials. Your applications using the Service Account (JWT) credentials will stop working after Jun 30, 2025. You must migrate to the new credential by **Jun 30, 2025**, to ensure your application continues functioning. [Learn more](../../ServerToServerAuthentication/migration). The following samples demonstrate JWT generation and exchanging it with Adobe IMS endpoint to retrieve an access token. @@ -20,4 +20,4 @@ The following samples demonstrate JWT generation and exchanging it with Adobe IM [Github repo](https://github.com/AdobeDocs/adobe-dev-console/tree/main/samples/adobe-jwt-dotnet) where you can find a complete sample C#.NET code to generate a JWT and exchanging it with Adobe IMS Endpoint to retrieve an access token. ### PHP Example -[Github repo](https://github.com/AdobeDocs/adobe-dev-console/tree/main/samples/adobe-jwt-php) where you can find PHP code example for JWT creation and reference method that exchanges JWT with Adobe IMS Endpoint to retrieve an access token. \ No newline at end of file +[Github repo](https://github.com/AdobeDocs/adobe-dev-console/tree/main/samples/adobe-jwt-php) where you can find PHP code example for JWT creation and reference method that exchanges JWT with Adobe IMS Endpoint to retrieve an access token. diff --git a/src/pages/guides/authentication/JWT/scopes.md b/src/pages/guides/authentication/JWT/scopes.md index dee44bf7..3607102f 100644 --- a/src/pages/guides/authentication/JWT/scopes.md +++ b/src/pages/guides/authentication/JWT/scopes.md @@ -3,7 +3,7 @@ -The Service Account (JWT) credentials have been deprecated in favor of the OAuth Server-to-Server credentials. Your applications using the Service Account (JWT) credentials will stop working after Jun 30, 2025. You must migrate to the new credential by **Jun 30, 2025**, to ensure your application continues functioning. [Learn more](../../ServerToServerAuthentication/migration.md). +The Service Account (JWT) credentials have been deprecated in favor of the OAuth Server-to-Server credentials. Your applications using the Service Account (JWT) credentials will stop working after Jun 30, 2025. You must migrate to the new credential by **Jun 30, 2025**, to ensure your application continues functioning. [Learn more](../../ServerToServerAuthentication/migration). JSON Web Token (JWT) metascopes govern the access and privileges for service accounts. As an application developer, you will choose the set of scopes to access certain resources by specifying the scopes as part of the encoding claims for your JWTs. diff --git a/src/pages/guides/authentication/OAuth/index.md b/src/pages/guides/authentication/OAuth/index.md index 411f2cec..57bdeac2 100644 --- a/src/pages/guides/authentication/OAuth/index.md +++ b/src/pages/guides/authentication/OAuth/index.md @@ -3,4 +3,4 @@ -The information on this page has been moved to our [user authentication guide](../UserAuthentication/index.md). \ No newline at end of file +The information on this page has been moved to our [user authentication guide](../UserAuthentication/). diff --git a/src/pages/guides/authentication/OAuth/samples.md b/src/pages/guides/authentication/OAuth/samples.md index d6fb0ecf..32db743e 100644 --- a/src/pages/guides/authentication/OAuth/samples.md +++ b/src/pages/guides/authentication/OAuth/samples.md @@ -2,4 +2,4 @@ -The information on this page has been moved to our [user authentication implementation guide](../UserAuthentication/implementation.md#standard-oauth2-libraries). \ No newline at end of file +The information on this page has been moved to our [user authentication implementation guide](../UserAuthentication/implementation#standard-oauth2-libraries). diff --git a/src/pages/guides/authentication/OAuth/scopes.md b/src/pages/guides/authentication/OAuth/scopes.md index 2d57ea43..0ac41c0a 100644 --- a/src/pages/guides/authentication/OAuth/scopes.md +++ b/src/pages/guides/authentication/OAuth/scopes.md @@ -2,4 +2,4 @@ -The information on this page has been moved to our [user authentication implementation guide](../UserAuthentication/implementation.md#oauth-20-scopes). +The information on this page has been moved to our [user authentication implementation guide](../UserAuthentication/implementation#oauth-20-scopes). diff --git a/src/pages/guides/authentication/ServerToServerAuthentication/faqs.md b/src/pages/guides/authentication/ServerToServerAuthentication/faqs.md index c56fee42..b3e265e9 100644 --- a/src/pages/guides/authentication/ServerToServerAuthentication/faqs.md +++ b/src/pages/guides/authentication/ServerToServerAuthentication/faqs.md @@ -32,12 +32,12 @@ A credential is used to uniquely identify your integration to Adobe. To use an A ### Will my Adobe integrations or applications stop working immediately? -No. Any integration or application using the Service Account (JWT) credential will continue to work until June 30, 2025. See [deprecation timelines](./migration.md#deperecation-timelines). See section on [migration next steps](#migration-next-steps). +No. Any integration or application using the Service Account (JWT) credential will continue to work until June 30, 2025. See [deprecation timelines](./migration#deperecation-timelines). See section on [migration next steps](#migration-next-steps). ### What is the deadline to migrate to the new credential? -You must migrate your application to use the new OAuth Server-to-Server credential before June 30, 2025, to ensure your application does not face any downtime. See [deprecation timelines](./migration.md#deperecation-timelines). See [migration guide](./migration.md). +You must migrate your application to use the new OAuth Server-to-Server credential before June 30, 2025, to ensure your application does not face any downtime. See [deprecation timelines](./migration#deperecation-timelines). See [migration guide](./migration). @@ -48,7 +48,7 @@ After June 30, 2025, you can no longer refresh certificates for integrations usi Furthermore, Adobe will automatically convert Service Account (JWT) to OAuth Server-to-Server credentials when certificates expire or on March 1, 2026, whichever comes first. ### We can currently create new Service Account (JWT) credentials even though they are marked as deprecated. Is it recommended? -No. Creating any new Service Account (JWT) credentials is not recommended. All Service Account (JWT) credentials, whether old or new, will stop working after June 30, 2025. We recommend you avoid migrating your application again and use the new OAuth Server-to-Server credential from the beginning. See our [implementation guide](./implementation.md). +No. Creating any new Service Account (JWT) credentials is not recommended. All Service Account (JWT) credentials, whether old or new, will stop working after June 30, 2025. We recommend you avoid migrating your application again and use the new OAuth Server-to-Server credential from the beginning. See our [implementation guide](./implementation). @@ -58,7 +58,7 @@ No. Creating any new Service Account (JWT) credentials is not recommended. All S ### What are the benefits of using the OAuth Server-to-Server credential? -You can read more about OAuth Server-to-Server credentials in our [implementation guide](./implementation.md). You can view the comparison between the OAuth Server-to-Server credential and the Service Account (JWT) credential [here](./migration.md#why-oauth-server-to-server-credentials). +You can read more about OAuth Server-to-Server credentials in our [implementation guide](./implementation). You can view the comparison between the OAuth Server-to-Server credential and the Service Account (JWT) credential [here](./migration#why-oauth-server-to-server-credentials). @@ -66,17 +66,17 @@ You can read more about OAuth Server-to-Server credentials in our [implementatio ### Can I programmatically rotate certificates for Service Account (JWT) credential? No such ability is currently available. There are no plans to add such ability either. -Instead, we recommend switching to the new credential that does not use expiring certificates and allows you to [rotate client secrets](./implementation.md#rotating-client-secrets) through the UI and API ([programmatically](./implementation.md#rotating-client-secrets-programmatically)). +Instead, we recommend switching to the new credential that does not use expiring certificates and allows you to [rotate client secrets](./implementation#rotating-client-secrets) through the UI and API ([programmatically](./implementation#rotating-client-secrets-programmatically)). ### Can I programmatically rotate client secrets for OAuth Server-to-Server credentials? -Absolutely. View our guide on rotating client secrets programmatically [here](./implementation.md#rotating-client-secrets-programmatically). +Absolutely. View our guide on rotating client secrets programmatically [here](./implementation#rotating-client-secrets-programmatically). ### What should I do if my client secrets get leaked? -We recommend immediately [rotating your application's client secret](./implementation.md#rotating-client-secrets) and contacting Adobe customer support if you wish to invalidate any existing tokens. +We recommend immediately [rotating your application's client secret](./implementation#rotating-client-secrets) and contacting Adobe customer support if you wish to invalidate any existing tokens. @@ -91,7 +91,7 @@ There are primarily three categories of integrations and custom applications tha These are integrations provided out-of-the-box by Adobe that require a Service Account (JWT) credential to function. Example: Integration between AEM and Adobe Target, Integration between AEM and Adobe Stock, User sync tool, etc. - For these integrations Adobe already supports the OAuth Server-to-Server credentials and allows you to migrate. Apart from our general-purpose [migration guide](./migration.md), you can also refer to the migration guide for [AEM customers](https://experienceleague.adobe.com/en/docs/experience-manager-cloud-service/content/security/jwt-credentials-deprecation-in-adobe-developer-console) and [User Sync tool customers](https://github.com/adobe-apiplatform/user-sync.py/blob/user-guide-wip/en/user-manual/connect_adobe.md). + For these integrations Adobe already supports the OAuth Server-to-Server credentials and allows you to migrate. Apart from our general-purpose [migration guide](./migration), you can also refer to the migration guide for [AEM customers](https://experienceleague.adobe.com/en/docs/experience-manager-cloud-service/content/security/jwt-credentials-deprecation-in-adobe-developer-console) and [User Sync tool customers](https://github.com/adobe-apiplatform/user-sync.py/blob/user-guide-wip/en/user-manual/connect_adobe). 2. **Integrations developed by vendors** @@ -101,7 +101,7 @@ There are primarily three categories of integrations and custom applications tha 3. **Custom integrations or applications** - These are integrations or application custom developed by an IT/development team in your organization. You are responsible for migrating these integrations. See our general-purpose [migration guide](./migration.md). + These are integrations or application custom developed by an IT/development team in your organization. You are responsible for migrating these integrations. See our general-purpose [migration guide](./migration). @@ -129,7 +129,7 @@ There are a few ways to see if a Project is actively being used: 1. Open an impacted Project and view the 'Last service activity' date on the overview page. You can also see this information on the list of Projects page. 2. Visit the Service Account (JWT) credential overview page and look at the last access token generated at timestamp. This will tell you when this Project was last used to generate an access token. -3. Visit the Insights tab in a Project to see recent activity (API calls, Events Delivered, etc.) involving the credentials contained in the Project. See our documentation on [Insights](../../insights.md) to know more. +3. Visit the Insights tab in a Project to see recent activity (API calls, Events Delivered, etc.) involving the credentials contained in the Project. See our documentation on [Insights](../../insights) to know more. diff --git a/src/pages/guides/authentication/ServerToServerAuthentication/implementation.md b/src/pages/guides/authentication/ServerToServerAuthentication/implementation.md index 988335ab..79d61bf0 100644 --- a/src/pages/guides/authentication/ServerToServerAuthentication/implementation.md +++ b/src/pages/guides/authentication/ServerToServerAuthentication/implementation.md @@ -1,7 +1,7 @@ # OAuth Server-to-Server credential implementation guide -The following guide goes over finer implementation details for OAuth Server-to-Server credentials. At the end of the guide is a list of recommended industry-standard OAuth2 libraries. Before you proceed, we recommend you become familiar with the server to server authentication credentials in our [server to server authentication guide](./index.md) +The following guide goes over finer implementation details for OAuth Server-to-Server credentials. At the end of the guide is a list of recommended industry-standard OAuth2 libraries. Before you proceed, we recommend you become familiar with the server to server authentication credentials in our [server to server authentication guide](./) ## Table of contents + [Setting up the OAuth Server-to-Server credential](#setting-up-the-oauth-server-to-server-credential) @@ -13,7 +13,7 @@ The following guide goes over finer implementation details for OAuth Server-to-S ## Setting up the OAuth Server-to-Server credential -Depending on the API or an Event to your project on the Adobe Developer Console, you can select the OAuth Server-to-Server credential. The OAuth Server-to-Server credential is available for all APIs and Events supporting the [Service Account (JWT) credential *(deprecated)*](./index.md#service-account-jwt-credential-deprecated). +Depending on the API or an Event to your project on the Adobe Developer Console, you can select the OAuth Server-to-Server credential. The OAuth Server-to-Server credential is available for all APIs and Events supporting the [Service Account (JWT) credential *(deprecated)*](./#service-account-jwt-credential-deprecated). ### Credential Name @@ -51,7 +51,7 @@ curl -X POST 'https://ims-na1.adobelogin.com/ims/token/v3' \ Your integration can generate access tokens when needed. However, it is a good practice to cache access tokens for reuse until they expire. Integrations should avoid generating a new access token when a previously generated access token has not expired and can be reused. Adobe can throttle your integration if it generates too many access tokens. -Access tokens usually expire in 24 hours. To check the expiry time of an access token, see the `expires_in` field in the API response returned by the above cURL request. Note: The `expires_in` time is in seconds. See [API reference](./ims.md#fetching-access-tokens). +Access tokens usually expire in 24 hours. To check the expiry time of an access token, see the `expires_in` field in the API response returned by the above cURL request. Note: The `expires_in` time is in seconds. See [API reference](./ims#fetching-access-tokens). ### Generating access tokens using standard OAuth2 libraries diff --git a/src/pages/guides/authentication/ServerToServerAuthentication/ims.md b/src/pages/guides/authentication/ServerToServerAuthentication/ims.md index bc4ab907..a623117e 100644 --- a/src/pages/guides/authentication/ServerToServerAuthentication/ims.md +++ b/src/pages/guides/authentication/ServerToServerAuthentication/ims.md @@ -48,18 +48,18 @@ You do not need a refresh token for OAuth Server-to-Server credentials. You can ## List all client secrets -Pre-requisite: You need to add `I/O Management API` to your project for fetching the list of secrets. See [Add API to a Project](../../services/services-add-api-jwt.md) +Pre-requisite: You need to add `I/O Management API` to your project for fetching the list of secrets. See [Add API to a Project](../../services/services-add-api-jwt) Note: No `client_secret` values are returned by this API. Only the secret `uuid` and other metadata is returned. ### Parameters -| Parameter | Where | Mandatory | Description | -| --------------- | ------- | --------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| `org_id` | URL | Yes | For instructions on where to find the `org_id`, see step 2 and 3 on our guide to [rotate secrets programmatically](./implementation.md#rotating-client-secrets-programmatically) | -| `credential_id` | URL | Yes | For instructions on where to find the `credential_id`, see step 2 and 3 on our guide to [rotate secrets programmatically](./implementation.md#rotating-client-secrets-programmatically) | -| `client_id` | Headers | Yes | The Client ID obtained from the [Adobe Developer Console](https://developer.adobe.com/console/) | -| `access_token` | Headers | Yes | For instructions on how to generate an access token, see step 5 on our guide to [rotate secrets programmatically](./implementation.md#rotating-client-secrets-programmatically) | +| Parameter | Where | Mandatory | Description | +| --------------- | ------- | --------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `org_id` | URL | Yes | For instructions on where to find the `org_id`, see step 2 and 3 on our guide to [rotate secrets programmatically](./implementation#rotating-client-secrets-programmatically) | +| `credential_id` | URL | Yes | For instructions on where to find the `credential_id`, see step 2 and 3 on our guide to [rotate secrets programmatically](./implementation#rotating-client-secrets-programmatically) | +| `client_id` | Headers | Yes | The Client ID obtained from the [Adobe Developer Console](https://developer.adobe.com/console/) | +| `access_token` | Headers | Yes | For instructions on how to generate an access token, see step 5 on our guide to [rotate secrets programmatically](./implementation#rotating-client-secrets-programmatically) | ### Request for OAuth Server-to-Server credential @@ -108,18 +108,18 @@ Note: the `created_at` and `last_used_at` values are in milliseconds since UNIX You can add up to 2 client secrets for an OAuth Server-to-Server credential. -Pre-requisite: You need to add `I/O Management API` to your project for adding client secret to the credential. See [Add API to a Project](../../services/services-add-api-jwt.md) +Pre-requisite: You need to add `I/O Management API` to your project for adding client secret to the credential. See [Add API to a Project](../../services/services-add-api-jwt) Note: The API response contains the the `client_secret` that was added and its `uuid`. This `client_secret` will never be returned in plain text by any other API response. However, you can still find it on the Developer Console UI. ### Parameters -| Parameter | Where | Mandatory | Description | -| --------------- | ------- | --------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| `org_id` | URL | Yes | For instructions on where to find the `org_id`, see step 2 and 3 on our guide to [rotate secrets programmatically](./implementation.md#rotating-client-secrets-programmatically) | -| `credential_id` | URL | Yes | For instructions on where to find the `credential_id`, see step 2 and 3 on our guide to [rotate secrets programmatically](./implementation.md#rotating-client-secrets-programmatically) | -| `client_id` | Headers | Yes | The Client ID obtained from the [Adobe Developer Console](https://developer.adobe.com/console/) | -| `access_token` | Headers | Yes | For instructions on how to generate an access token, see step 5 on our guide to [rotate secrets programmatically](./implementation.md#rotating-client-secrets-programmatically) | +| Parameter | Where | Mandatory | Description | +| --------------- | ------- | --------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `org_id` | URL | Yes | For instructions on where to find the `org_id`, see step 2 and 3 on our guide to [rotate secrets programmatically](./implementation#rotating-client-secrets-programmatically) | +| `credential_id` | URL | Yes | For instructions on where to find the `credential_id`, see step 2 and 3 on our guide to [rotate secrets programmatically](./implementation#rotating-client-secrets-programmatically) | +| `client_id` | Headers | Yes | The Client ID obtained from the [Adobe Developer Console](https://developer.adobe.com/console/) | +| `access_token` | Headers | Yes | For instructions on how to generate an access token, see step 5 on our guide to [rotate secrets programmatically](./implementation#rotating-client-secrets-programmatically) | ### Request for OAuth Server-to-Server credential @@ -149,19 +149,19 @@ Note: the `created_at` and `last_used_at` values are in milliseconds since UNIX ## Remove client secret from credential -Pre-requisite: You need to add `I/O Management API` to your project for removing client secret from the credential. See [Add API to a Project](../../services/services-add-api-jwt.md) +Pre-requisite: You need to add `I/O Management API` to your project for removing client secret from the credential. See [Add API to a Project](../../services/services-add-api-jwt) Note: you need the secret `uuid` to delete a secret. You cannot use the plain text `client_secret` value to identify which secret to delete. ### Parameters -| Parameter | Where | Mandatory | Description | -| --------------- | ------- | --------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| `org_id` | URL | Yes | For instructions on where to find the `org_id`, see step 2 and 3 on our guide to [rotate secrets programmatically](./implementation.md#rotating-client-secrets-programmatically) | -| `credential_id` | URL | Yes | For instructions on where to find the `credential_id`, see step 2 and 3 on our guide to [rotate secrets programmatically](./implementation.md#rotating-client-secrets-programmatically) | -| `uuid` | URL | Yes | The uuid of the secret you wish to delete. See the [list all secrets API](#list-all-client-secrets) to get the secret's `uuid`. | -| `client_id` | Headers | Yes | The Client ID obtained from the [Adobe Developer Console](https://developer.adobe.com/console/) | -| `access_token` | Headers | Yes | For instructions on how to generate an access token, see step 5 on our guide to [rotate secrets programmatically](./implementation.md#rotating-client-secrets-programmatically) | +| Parameter | Where | Mandatory | Description | +| --------------- | ------- | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | +| `org_id` | URL | Yes | For instructions on where to find the `org_id`, see step 2 and 3 on our guide to [rotate secrets programmatically](./implementation#rotating-client-secrets-programmatically) | +| `credential_id` | URL | Yes | For instructions on where to find the `credential_id`, see step 2 and 3 on our guide to [rotate secrets programmatically](./implementation#rotating-client-secrets-programmatically) | +| `uuid` | URL | Yes | The uuid of the secret you wish to delete. See the [list all secrets API](#list-all-client-secrets) to get the secret's `uuid`. | +| `client_id` | Headers | Yes | The Client ID obtained from the [Adobe Developer Console](https://developer.adobe.com/console/) | +| `access_token` | Headers | Yes | For instructions on how to generate an access token, see step 5 on our guide to [rotate secrets programmatically](./implementation#rotating-client-secrets-programmatically) | ### Request for OAuth Server-to-Server credential @@ -173,4 +173,4 @@ curl -X DELETE 'https://api.adobe.io/console/organizations/{org_id}/credentials/ ### Sample Response -204 No Content \ No newline at end of file +204 No Content diff --git a/src/pages/guides/authentication/ServerToServerAuthentication/index.md b/src/pages/guides/authentication/ServerToServerAuthentication/index.md index 368866dd..4ac0bcb8 100644 --- a/src/pages/guides/authentication/ServerToServerAuthentication/index.md +++ b/src/pages/guides/authentication/ServerToServerAuthentication/index.md @@ -38,17 +38,17 @@ As the token generation logic uses your `client_secret`, this logic must be impl Read our OAuth Server-to-server credential implementation guide - -1. [Generating access tokens using cURL](./implementation.md#generate-access-tokens) -2. [Generating access tokens programmatically using standard OAuth2 libraries](./implementation.md#rotating-client-secrets-programmatically) -3. [Migrating from Service Account (JWT) credentials to OAuth Server-to-Server credentials](./migration.md) -4. [API reference](./ims.md) +1. [Generating access tokens using cURL](./implementation#generate-access-tokens) +2. [Generating access tokens programmatically using standard OAuth2 libraries](./implementation#rotating-client-secrets-programmatically) +3. [Migrating from Service Account (JWT) credentials to OAuth Server-to-Server credentials](./migration) +4. [API reference](./ims) ### Service Account (JWT) credential *(deprecated)* -The Service Account (JWT) credentials have been deprecated in favor of the OAuth Server-to-Server credentials. Your applications using the Service Account (JWT) credentials will stop working after Jun 30, 2025. You must migrate to the new credential by **Jun 30, 2025**, to ensure your application continues functioning. [Learn more](../ServerToServerAuthentication/migration.md). +The Service Account (JWT) credentials have been deprecated in favor of the OAuth Server-to-Server credentials. Your applications using the Service Account (JWT) credentials will stop working after Jun 30, 2025. You must migrate to the new credential by **Jun 30, 2025**, to ensure your application continues functioning. [Learn more](../ServerToServerAuthentication/migration). Service Account (JWT) credentials rely on the JWT token exchange mechanism to generate access tokens. This credential's details include two secrets a `client_secret` and a `private.key` (part of a public certificate private key pair). @@ -58,5 +58,5 @@ As the token generation logic uses your `client_secret`, this logic must be impl Read our Service Account (JWT) credential implementation guide - -1. [Generating access tokens programmatically](../JWT/index.md) -2. [Migrating from Service Account (JWT) credentials to OAuth Server-to-Server credentials](./migration.md) +1. [Generating access tokens programmatically](../JWT/) +2. [Migrating from Service Account (JWT) credentials to OAuth Server-to-Server credentials](./migration) diff --git a/src/pages/guides/authentication/ServerToServerAuthentication/migration.md b/src/pages/guides/authentication/ServerToServerAuthentication/migration.md index 2342c26c..effc5f2c 100644 --- a/src/pages/guides/authentication/ServerToServerAuthentication/migration.md +++ b/src/pages/guides/authentication/ServerToServerAuthentication/migration.md @@ -26,19 +26,19 @@ If you have more questions, check out our [frequently asked questions](#faqs) or ## Why OAuth Server-to-Server credentials? -The new OAuth Server-to-Server credentials rely on the OAuth 2.0 client credentials grant. Therefore, you can use industry-standard [OAuth 2.0 libraries](./implementation.md#generating-access-tokens-using-standard-oauth2-libraries) to implement access token generation in your application. +The new OAuth Server-to-Server credentials rely on the OAuth 2.0 client credentials grant. Therefore, you can use industry-standard [OAuth 2.0 libraries](./implementation#generating-access-tokens-using-standard-oauth2-libraries) to implement access token generation in your application. Unlike the Service Account (JWT) credential, the new credential does not use a public certificate and private key pair to generate access tokens. As an application developer, you do not have to periodically rotate the public certificates and private key pairs when they expire. Also, the credential setup process is greatly simplified, and you do not have to download and save the private key on your machine. -Lastly, while the new OAuth Server-to-Server credentials do not use expiring certificates, they still allow client secret rotation through the UI and API. Read more about [rotating secrets programmatically](./implementation.md#rotating-client-secrets-programmatically) in our guide on [rotating client secrets](./implementation.md#rotating-client-secrets). +Lastly, while the new OAuth Server-to-Server credentials do not use expiring certificates, they still allow client secret rotation through the UI and API. Read more about [rotating secrets programmatically](./implementation#rotating-client-secrets-programmatically) in our guide on [rotating client secrets](./implementation#rotating-client-secrets). | | OAuth Server-to-Server credential | Service Account (JWT) credential | |------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------| | Do expiring certificates need to be replaced every year? | This credential does not use public certificates or private key pairs. You are not forced to rotate certificates every year. | You need to rotate the public certificate and private key pair every year. | -| Generating access tokens for experimentation | You can generate an access token for quick experimentation with a [one-click button](./implementation.md#generate-access-tokens) on the Developer Console. | Generating access tokens is a 3-step process spanning the Developer Console UI and your command-line terminal. | -| Generating access tokens in your application | You can use [standard OAuth 2.0 libraries](./implementation.md#generating-access-tokens-using-standard-oauth2-libraries) to generate access tokens in your application programmatically.| You can implement access token generation programmatically by reading our documentation. | -| Rotating client secrets programmatically | You can rotate client secrets on-demand through the Dev Console UI and API. [Learn more](./implementation.md#rotating-client-secrets-programmatically).| You can rotate the public certificate and private key pair manually through the UI. | +| Generating access tokens for experimentation | You can generate an access token for quick experimentation with a [one-click button](./implementation#generate-access-tokens) on the Developer Console. | Generating access tokens is a 3-step process spanning the Developer Console UI and your command-line terminal. | +| Generating access tokens in your application | You can use [standard OAuth 2.0 libraries](./implementation#generating-access-tokens-using-standard-oauth2-libraries) to generate access tokens in your application programmatically.| You can implement access token generation programmatically by reading our documentation. | +| Rotating client secrets programmatically | You can rotate client secrets on-demand through the Dev Console UI and API. [Learn more](./implementation#rotating-client-secrets-programmatically).| You can rotate the public certificate and private key pair manually through the UI. | ## Deprecation Timelines @@ -98,7 +98,7 @@ Adding an equivalent OAuth Server-to-Server credential will not impact your runn * At this point, you can use either credential to generate access tokens. This ensures that your running application can continue generating access tokens using the Service Account (JWT). - * Meanwhile, you can test the new credential by generating access tokens using the Developer Console UI or a cURL command. We also recommend reading our [implementation guide](./implementation.md) that points to several [standard OAuth 2.0 libraries](./implementation.md#generating-access-tokens-using-standard-oauth2-libraries) to generate access tokens programmatically. + * Meanwhile, you can test the new credential by generating access tokens using the Developer Console UI or a cURL command. We also recommend reading our [implementation guide](./implementation) that points to several [standard OAuth 2.0 libraries](./implementation#generating-access-tokens-using-standard-oauth2-libraries) to generate access tokens programmatically. ### Step 2: Update your application and delete old credential diff --git a/src/pages/guides/authentication/Tools/index.md b/src/pages/guides/authentication/Tools/index.md index c21d09f1..9c6a6836 100644 --- a/src/pages/guides/authentication/Tools/index.md +++ b/src/pages/guides/authentication/Tools/index.md @@ -5,8 +5,8 @@ ## OAuth 2.0 Playground Do you have an OAuth integration created? -[Try the OAuth 2.0 Playground tool](o-auth-playground.md) to generate an access token. +[Try the OAuth 2.0 Playground tool](o-auth-playground) to generate an access token. ## Postman -[Try Postman for generating an access token](postman.md) for both OAuth and Service Account Integration. +[Try Postman for generating an access token](postman) for both OAuth and Service Account Integration. diff --git a/src/pages/guides/authentication/Tools/o-auth-playground.md b/src/pages/guides/authentication/Tools/o-auth-playground.md index 81f74cef..78d868e2 100644 --- a/src/pages/guides/authentication/Tools/o-auth-playground.md +++ b/src/pages/guides/authentication/Tools/o-auth-playground.md @@ -10,11 +10,11 @@ The OAuth 2.0 Playground is an Adobe internet utility that enables developers to 2. Go to the [Adobe Developer Console](https://developer.adobe.com/console/) -3. Create a project within Console. For complete steps to creating a project in Console, begin by reading the [Adobe Developer Console getting started guide](../../getting-started.md) and [projects overview](../../projects/index.md). +3. Create a project within Console. For complete steps to creating a project in Console, begin by reading the [Adobe Developer Console getting started guide](../../getting-started) and [projects overview](../../projects/). 4. Once you have created a project, you will be able to add services including APIs, Adobe I/O Events registrations, and Adobe I/O Runtime. Add an API to your project and then select the services with which you wish to integrate (such as Adobe Analytics > OAuth 2.0 Integration) - To add an API that uses OAuth authentication and authorization, follow the steps outlined in the guide for [adding an API to a project using OAuth authentication](../../services/services-add-api-oauth.md). + To add an API that uses OAuth authentication and authorization, follow the steps outlined in the guide for [adding an API to a project using OAuth authentication](../../services/services-add-api-oauth). When the API has been successfully connected, you will be able to access the newly generated credentials including Client ID and Client Secret. diff --git a/src/pages/guides/authentication/Tools/postman.md b/src/pages/guides/authentication/Tools/postman.md index 5d516652..bd37904e 100644 --- a/src/pages/guides/authentication/Tools/postman.md +++ b/src/pages/guides/authentication/Tools/postman.md @@ -25,7 +25,7 @@ openid,AdobeID,read_organizations,additional_info.projectedProductContext,additional_info.job_function ``` -*Note: If you are not sure about scope, refer to [Scope Reference](../OAuth/scopes.md).* +*Note: If you are not sure about scope, refer to [Scope Reference](../OAuth/scopes).* ![pm-4](../Images/PM_4.png) @@ -89,4 +89,4 @@ curl https://stock.adobe.io/Rest/Media/1/Search/Files?locale=en_US%26search_para ![pmw-3](../Images/PMW_3.png) - *Note: You can import any CURL Request into Postman by following the above steps.* \ No newline at end of file + *Note: You can import any CURL Request into Postman by following the above steps.*