Quickstart

Connect a public integration to one Alution Cloud tenant using OAuth 2.0 Authorization Code with PKCE.

Create the authorization request

Generate and retain a random code_verifier and state. Derive the S256 code_challenge, then open the tenant authorization URL:

https://{tenant}.alution.cloud/oauth/authorize?response_type=code&client_id={client_id}&redirect_uri={encoded_redirect_uri}&scope=profile%3Aread&state={state}&code_challenge={challenge}&code_challenge_method=S256

Never reuse the verifier or state. On the callback, reject the response unless its state matches the value stored for that browser session.

Exchange the code

curl -X POST https://{tenant}.alution.cloud/oauth/token \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "authorization_code",
    "client_id": "YOUR_CLIENT_ID",
    "redirect_uri": "https://example.com/oauth/callback",
    "code": "CODE_FROM_CALLBACK",
    "code_verifier": "THE_ORIGINAL_VERIFIER"
  }'

The response contains access_token, refresh_token, token_type, and expires_in. Access tokens last 15 minutes; refresh tokens last 30 days.

Call the API

curl https://{tenant}.alution.cloud/api/v1/auth/user \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Accept: application/json"

Use the same tenant host for authorization, token exchange, and API calls. Continue with Authentication for scopes and lifecycle guidance.