OAuth 2.0 client credentials, step by step
Order sync job
Microsoft Entra ID
Orders API
On the wire
POST /{tenant}/oauth2/v2.0/token
grant_type=client_credentials
client_id=6f1c…e2a9
scope=api://orders/.default
client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer
client_assertion=eyJhbGciOiJSUzI1NiIsIng1dCI6…Decoded access token
- iss•••••
- aud•••••
- exp•••••
- roles•••••
- azp•••••
Illustrative example
Authentication mechanisms
OAuth 2.0 & OpenID Connect
Industry-standard protocols for authorization and authentication. Learn about Microsoft identity platform.
- Authorization code flow: For web applications with backend
- Client credentials flow: For machine-to-machine communication
- PKCE: Enhanced security for mobile and SPA applications
- JWT tokens: Stateless authentication with claims
API keys
Simple authentication for server-to-server scenarios:
- Send API key in header:
X-API-Key: your-key-here - Store keys securely in Azure Key Vault
- Implement key rotation and expiration policies
- Use different keys for dev, staging, production
Managed identities
Microsoft Entra ID authentication without credentials in code:
- System-assigned identities for Azure resources
- User-assigned identities for shared resources
- Automatic token acquisition and renewal
- Works with Azure SQL, storage, Key Vault, and more
Authorization patterns
Role-based access control (RBAC)
Assign permissions based on user roles:
- Define roles: Admin, Manager, User, ReadOnly
- Decorate endpoints with
[Authorize(Roles = "Admin")] - Store roles in JWT claims or database
- Support multiple roles per user
Claims-based authorization
Fine-grained authorization based on user attributes:
- Check specific claims: department, location, age
- Policy-based authorization with custom requirements
- Combine multiple claims for complex rules
Security best practices
Essential security measures
- HTTPS only: Enforce TLS 1.2+ for all API traffic
- Input validation: Validate and sanitize all user input
- Rate limiting: Prevent abuse with throttling policies
- CORS: Configure Cross-Origin Resource Sharing properly
- SQL injection prevention: Use parameterized queries
- XSS protection: Encode output, sanitize input
- Secrets management: Never hardcode credentials
- Security headers: X-Frame-Options, CSP, HSTS