OAuth 2.0 tutorial

Once your application is properly configured, it's time to request an access token. An access Token is a JSON Web Token (JWT, aka the JOT token). The JWT token will contain the user/service account profile information together with expiry time and issuer details. The request access token can be used as a bearer token to invoke Experian APIs and allow your application to access products and APIs. A refresh token is also issued, so applications can renew expired access tokens.

Below is the sample under the Sandbox environment for the access_token request which includes token endpoint, headers and payload.

Response:

Below is a sample response which includes status code and token information:

{
  "issued_at"  : "1509914612223",
  "expires_in" : "1800",
  "token_type" : "Bearer",
  "access_token" : "<ACCESS_TOKEN>",
  "refresh_token" : "<REFRESH_TOKEN>"
}

TOKEN CACHING: Please note that it is expected that the full lifespan of the access token (30 minutes) is taken advantage of by implementing TOKEN CACHING.  We recommend that you generate a new access token to be securely cached in order to feed your Service API calls until the 28 or 29 minute mark.  At this point then a new access token can be generated to substitute the expiring one in the cache to again start the cycle.  Doing this is beneficial to your company and Experian systems as it minimizes the number of access token calls sent therefore avoiding unnecessary overhead on both sides.

Once you've obtained an Access Token, you can start making authenticated API requests. This is accomplished by including an "Authorization" header as a Bearer token in your HTTP call to Experian’s API.  Here is a sample HTTP request including the header value that includes the token:

'Authorization: Bearer $ACCESS_TOKEN’

For example, to make an API call as shown below:  the access token has been passed as a Bearer token

curl -X GET https://sandbox-us-api.experian.com/business/score/v2/directors \
     -H "Accept: application/json" \
     -H "Authorization: Bearer $ACCESS_TOKEN" \

You may obtain a new access_token, whenever the access_token has expired, by exchanging the refresh_token that is associated with the access_token.

Below is a sample request:

curl -X POST https://sandbox-us-api.experian.com/oauth2/v1/token \
  -H 'accept: application/json' \
  -H 'content-type: application/json' \
  -H 'client_id: <CLIENT_ID>' \
  -H 'client_secret: <CLIENT_SECRET>' \
  -H 'grant_type: refresh_token' \
  -H 'refresh_token: $REFRESH_TOKEN' \

Response

{
  "issued_at" : "1500914612223",
  "expires_in" : "1800",
  "token_type" : "Bearer",
  "access_token" : "$ACCESS TOKEN",
  “refresh_token”: “$REFRESH TOKEN”
}

If the client chooses to revoke generated access and refresh tokens, it can be done by calling the revoke token endpoint. To revoke a token, a client application would make a request to the revocation endpoint as shown in the below sample in the sandbox environment:

curl -X POST https://sandbox-us-api.experian.com/oauth2/v1/revokeToken \
  -H 'client_id: GfiivuSKYI8oU5X6QQmAdGrXlNGkp8Ex' \
  -H 'client_secret: XM2qQ4XapHjPEbZ6' \
  -H 'token: eyJraWQiOiJBSmpTMXJQQjdJODBHWjgybmNsSlZPQkF3V3B3ZTVYblNKZUdSZH' \

Response

Status code 200

ERRORS