Authentication

Alution Cloud uses OAuth 2.0 Authorization Code with PKCE for public integrations. Send the resulting access token with the standard Authorization: Bearer header.

Authorization Code with PKCE

Create a cryptographically random code_verifier (43–128 URL-safe characters), then calculate BASE64URL(SHA256(code_verifier)) as the code_challenge. Store the verifier and a random state value in the user session.

Redirect the browser to:

GET https://{tenant}.alution.cloud/oauth/authorize
  ?response_type=code
  &client_id={client_id}
  &redirect_uri={redirect_uri}
  &scope={space_separated_scopes}
  &state={unpredictable_state}
  &code_challenge={challenge}
  &code_challenge_method=S256

state, response_type=code, and code_challenge_method=S256 are required. After approval, verify that the returned state exactly matches the stored value before exchanging code at /oauth/token. The redirect_uri must exactly match a URI registered for the OAuth client.

Use the access token on API requests:

curl https://{tenant}.alution.cloud/api/v1/auth/user \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Accept: application/json"

Access tokens expire after 15 minutes. Refresh tokens expire after 30 days. Store both securely and never expose a refresh token to logs, URLs, or third parties.

Scopes

Request only the capabilities your integration needs. Available scopes are:

profile:read
users:read users:write
contacts:read contacts:write
tickets:read tickets:write
files:read files:write
settings:read settings:write
custom-fields:read custom-fields:write
math-scripts:read math-scripts:write
policy-groups:read policy-groups:write
products:read products:write
projects:read
devices:read
contracts:read
contract-options:read
record-types:read
mail-messages:read mail-messages:write
ticket-filters:read ticket-filters:write
providers:read providers:write
schemas:read
table-layouts:read
text-templates:read text-templates:write
transfers:read transfers:write
realtime:connect

If a route checks multiple scopes, satisfying one of the accepted scopes is sufficient. A token without the required scope receives 403 Forbidden.

Refresh and revoke

Exchange a valid refresh token with grant_type=refresh_token before the access token expires. Replace the stored refresh token if the response rotates it. To disconnect an integration, revoke the current access token at /oauth/revoke; see Tokens for exact requests.