Yappes OAuth¶

Overview¶

Yappes OAuth is a platform-managed OAuth 2.0 authentication model. The platform admin configures the OAuth server in the Admin Console; API providers enable Yappes OAuth on APIs and define scopes per endpoint; consumers receive per-application client credentials after subscription.

Open flows in API Manager under Manage APIs, Application, API Marketplace → My Subscriptions, and Approval Workflow → Pending Approvals.

Why This Matters¶

• Platform-managed token issuance and validation — no external OAuth server required.
• Fine-grained access control through per-endpoint scopes.
• Consumers select scopes when creating applications; approvers can review scope selections.
• Gateway-enforced protection for subscribed APIs (not limited to Tryout).

Yappes OAuth vs OAuth 2 (upstream):

Roles¶

End-to-End Flow¶

sequenceDiagram
    participant Admin as Platform Admin
    participant Provider as API Provider
    participant Consumer as Consumer
    participant Approver as Approver
    participant Platform as Platform OAuth Server

    Admin->>Platform: Configure OAuth 2.0 in Admin Console
    Provider->>Provider: Enable Yappes OAuth on API
    Provider->>Provider: Define scopes per endpoint
    Consumer->>Consumer: Create application and select scopes
    Approver->>Consumer: Approve scope selections
    Consumer->>Platform: Request token with client credentials
    Platform->>Consumer: Return access token
    Consumer->>Provider: Call API with Bearer token

1. Admin configures token endpoints in OAuth 2.0 Configuration.
2. Provider enables Yappes OAuth on the API (Step 2 → Authentication).
3. Provider adds scopes per endpoint (Step 2 → Endpoint Details → OAuth tab).
4. Consumer creates an application and selects scopes per OAuth-enabled API.
5. Approver reviews scope selections (if an approval workflow is attached).
6. Consumer views credentials in My Subscriptions → Security.
7. Consumer uses Sample Request (auto-generated Bearer token) or calls the token URL manually.

Provider: Enable Yappes OAuth on an API¶

Path: Manage APIs → My APIs → edit API → Step 2

Roles: api-developer, api-product-manager, or platform-admin

1. Go to the Authentication section and click Add.
2. Select Yappes OAuth as the authentication type.
3. Review the prefilled, read-only fields:
4. Access Token URL — from Admin Console OAuth config
5. Refresh Token URL — from Admin Console OAuth config
6. Available Scopes — auto-populated from endpoint scopes (read-only multiselect)
7. Click Add Authentication.

For general onboarding context, see Onboard APIs.

Provider: Define OAuth Scopes¶

Path: Step 2 → Endpoint Details → OAuth tab

The OAuth tab is visible only when the API authentication type is Yappes OAuth.

1. Open the OAuth tab for an endpoint.
2. Click Add Scope.
3. Enter scope details:

1. Click Add to save the scope.
2. Repeat for each endpoint that requires scoped access.
3. To remove a scope from an unpublished API, use Delete on the scope row.

Provider: Tryout with Yappes OAuth¶

Path: Step 2 → Tryout

When Yappes OAuth is enabled:

1. An info banner explains that you need an application subscription with client credentials.
2. Open the Tryout Auth modal and enter Client ID and Client Secret from a subscribed application.
3. On successful authentication, the Bearer token is applied to Tryout requests.
4. Until authenticated, the request shows a placeholder [your auth token].

Consumer: Create Application with Scopes¶

Path: Manage APIs → Application → Create Application

Roles: api-consumer, api-developer, or organization owner

For the full step-by-step walkthrough, see Creating an application.

Attach to API¶

1. Select Attach to → API and choose one or more APIs.
2. Select a rate plan for each API.
3. For OAuth-enabled APIs, click the API pill under OAuth enabled API (Click API to view the Scopes).
4. In the Api Scope Details modal, check or uncheck scopes, then click Save.
5. Click Submit for Approval.

Attach to API Group¶

1. Select Attach to → API Group and choose one or more groups.
2. Select a rate plan for each group.
3. For groups containing OAuth-enabled APIs, click the pill for each OAuth API within the group.
4. Configure scopes in the Api Scope Details modal for each API.
5. Click Submit for Approval.

Edit Application Scopes¶

Path: Manage APIs → Application → View → Details

Consumers can update OAuth scope selections on an existing application using the same Api Scope Details modal as create. Click an OAuth API pill, adjust scopes, click Save, then Update.

There is no read-only scope summary on the consumer Details tab. Approvers review scope selections in Pending Approvals.

For field-level details, see Application Details.

Approver: Review OAuth Scopes¶

Path: Approval Workflow → Pending Approvals

When reviewing an application subscription request:

1. Open the approval modal for the application subscription.
2. OAuth-enabled APIs appear as selectable pills.
3. Select or unselect scopes per OAuth API.
4. Approve or reject the request with optional comments.

For general approval workflow guidance, see Pending Approvals.

Consumer: Credentials and API Access¶

Path: API Marketplace → My Subscriptions

After subscribing with a Yappes OAuth-enabled API:

Security tab¶

The Security tab shows read-only fields with copy buttons:

Sample Request tab¶

For Yappes OAuth subscriptions, the Sample Request tab automatically:

1. Retrieves client credentials for the application.
2. Requests an access token using the client_credentials grant.
3. Injects the Bearer token into the sample cURL command.

Manual token request¶

You can also request a token directly:

curl -X POST "<access_token_url>" \
  -H "Content-Type: application/json" \
  -d '{"grant_type":"client_credentials","client_id":"<client_id>","client_secret":"<client_secret>"}'

Use the returned access_token in API requests:

curl -X GET "<api_endpoint_url>" \
  -H "Authorization: Bearer <access_token>"

For subscription management details, see My Subscriptions.