Introduction

The following tutorial explains how to use OAuth2 with the Bazaarvoice Transactions API using a two-legged workflow, which authenticates directly between the OAuth2 API and your Transactions application.

Bazaarvoice has implemented 2-legged OAuth2, an open standard for access delegation. This style of OAuth is referred to as “2-legged” because it consists of two roles:

• The Client Application : This is an application that would like to access data or interact with a Bazaarvoice service.
• The OAuth2 API: A Bazaarvoice service that implements the OAuth2 standard and intermediates with the Client Application.

2-legged OAuth2 offers certain advantages including:

• Authentication is handled server to client and does not require an end user to manually supply credentials.
• As a well-known open standard, OAuth2 is easier to implement than a custom solution.

Continue reading to learn how to use OAuth2 to access the supported Bazaarvoice APIs.

Walkthrough

The following sections describe the recommended method for implementing authentication for your application. The API calls you make to the OAuth2 API count towards your passkey's rate limit and quota, so correct implementation is highly recommended.
The Bazaarvoice OAuth2 integration can be divided into the following action:

• Token exchange
  1. Description: Client Application submits the Client Secret and Client ID to Bazaarvoice. If they are valid, Bazaarvoice will return an Access Token that the Client Application can use when making requests to a Bazaarvoice Service.
  2. When to perform: When you don’t have a valid Access Token.

Token Exchange

Step 1: Requesting an Access Token with the Client Secret and Client ID

The Client Application requests a token by submitting the application credentials to the OAuth2 API, as depicted below:

❗️

This request should be done on the server and should use HTTPS.

Request :

POST https://[stg.]api.bazaarvoice.com/auth/v1/oauth2/token
Content-Type: application/x-www-form-urlencoded
…

grant_type=client_credentials&client_id={CLIENT_ID}&client_secret={CLIENT_SECRET}

Ellipsis (…) in the example above indicate your application may generate other headers.

If successful, the OAuth2 API will respond with the following Access Token data:

Response:

{
  "access_token": "{ACCESS_TOKEN}",
  "token_type": "Bearer",
  "expires_at": {TIME_STAMP},
  "scope": "offline_access",
  "refresh_token": "null"
}

The Access Token can now be used to authenticate requests to other Bazaarvoice services.

🚧

Please use the example provided for generating the bearer token. The bearer can then be used to serve as authentication for subsequent Transactions API calls

Step 2: Persist the token data

The Client Application should store the entire token response object. Exactly how this is accomplished is up to the Client Application developer.

❗️

Don't expose the token response object to the public. It should be kept private and secure at all times.