Skip to content

Commit 67dd658

Browse files
pmalouinpmalouin
committed
feat: add a few more instructions for tenant setup of connected accounts
1 parent b070ad4 commit 67dd658

File tree

2 files changed

+107
-2
lines changed

2 files changed

+107
-2
lines changed

‎examples/calling-apis/chatbot/README.md‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,62 @@ This is a [Next.js](https://nextjs.org) application that implements [Auth0 AI](h
2525
- Note down the "Client ID" and "Client Secret" of this newly created Custom API Client.
2626
- Either **Google**, **Slack** or **GitHub** social connections enabled for the application.
2727

28+
29+
### Pre-requisite: Define a Multi-Resource Refresh Token policy for the Custom API Client
30+
31+
When a call to Token Vault fails due to the user not having a connected account (or lacking some permissions), this demo triggers a Connect Account flow for this user. This flow leverages Auth0 [My Account API](https://auth0.com/docs/manage-users/my-account-api), and as such, your application will need to have access to it in order to enable this flow.
32+
33+
In order to grant access from your Web Application to the My Account API, you will need to leverage the [Multi-Resource Refresh Token](https://auth0.com/docs/secure/tokens/refresh-tokens/multi-resource-refresh-token) feature, where the refresh tokens delivered to your SPA will also allow it to obtain an access token to call My Account API.
34+
35+
This will require defining a new [refresh token policy](https://auth0.com/docs/secure/tokens/refresh-tokens/multi-resource-refresh-token/configure-and-implement-multi-resource-refresh-token) for your client where the `audience` is `https://<your auth0 domain>/me/` and the `scope` should include at least the `"create:me:connected_accounts"` scope.
36+
37+
The configuration page explains how to achieve this using various tools, but here is an example showing how to do it with `curl`:
38+
39+
```shell
40+
curl --request PATCH \
41+
--url 'https://{yourDomain}/api/v2/clients/{yourClientId}' \
42+
--header 'authorization: Bearer {yourMgmtApiAccessToken}' \
43+
--header 'content-type: application/json' \
44+
--data '{
45+
"refresh_token": {
46+
"expiration_type": "expiring",
47+
"rotation_type": "rotating",
48+
"token_lifetime": 31557600,
49+
"idle_token_lifetime": 2592000,
50+
"leeway": 0,
51+
"infinite_token_lifetime": false,
52+
"infinite_idle_token_lifetime": false,
53+
"policies": [
54+
{
55+
"audience": "https://{yourDomain}/me/",
56+
"scope": [
57+
"create:me:connected_accounts"
58+
]
59+
}
60+
]
61+
}
62+
}'
63+
```
64+
65+
### Pre-requisite: Grant access to My Account API from your application
66+
67+
In order to grant access, use the [Application Access to APIs](https://auth0.com/docs/get-started/applications/application-access-to-apis-client-grants) feature, by creating a client grant for user flows.
68+
69+
```shell
70+
curl --location 'https://{yourDomain}/api/v2/client-grants' \
71+
--header 'Content-Type: application/json' \
72+
--header 'Authorization: Bearer {YOUR_MANAGEMENT_API_TOKEN}' \
73+
--data '{
74+
"client_id": "{CLIENT_ID}",
75+
"audience": "https://{yourDomain}/me/",
76+
"scope": [
77+
"create:me:connected_accounts"
78+
],
79+
"subject_type": "user"
80+
}'
81+
```
82+
83+
2884
### Setup the workspace `.env` file
2985

3086
Copy the `.env.example` file to `.env` and fill in the values for the following variables, using the settings obtained from the prerequisites:

‎examples/calling-apis/spa-with-backend-api/react-hono-ai-sdk/README.md‎

Lines changed: 51 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -71,9 +71,58 @@ You will need the following prerequisites to run this app:
7171
- In your Auth0 Dashboard, on the configuration page of your API, click the "Add Application" button in the header and create the Custom API Client
7272
- Ensure that the `Token Vault` grant type is enabled under the Advanced Settings
7373
- Note down the "Client ID" and "Client Secret" of this newly created Custom API Client
74-
- This client enables Token Vault to exchange an access token for an external API access token (e.g., Google Calendar API)
74+
- Now your Custom API will be able to use Token Vault, to exchange an access token for an external API access token (e.g., Google Calendar API)
75+
76+
4. Define a Multi-Resource Refresh Token policy for the Custom API Client
77+
- When a call to Token Vault fails due to the user not having a connected account (or lacking some permissions), this demo triggers a Connect Account flow for this user. This flow leverages Auth0 [My Account API](https://auth0.com/docs/manage-users/my-account-api), and as such, your application will need to have access to it in order to enable this flow.
78+
- In order to grant access from your SPA Application to the My Account API, you will need to leverage the [Multi-Resource Refresh Token](https://auth0.com/docs/secure/tokens/refresh-tokens/multi-resource-refresh-token) feature, where the refresh tokens delivered to your SPA will also allow it to obtain an access token to call My Account API.
79+
- This will require defining a new [refresh token policy](https://auth0.com/docs/secure/tokens/refresh-tokens/multi-resource-refresh-token/configure-and-implement-multi-resource-refresh-token) for your SPA client where the `audience` is `https://<your auth0 domain>/me/` and the `scope` should include at least the `"create:me:connected_accounts"` scope.
80+
- The configuration page explains how to achieve this using various tools, but here is an example showing how to do it with `curl`:
81+
82+
```shell
83+
curl --request PATCH \
84+
--url 'https://{yourDomain}/api/v2/clients/{yourClientId}' \
85+
--header 'authorization: Bearer {yourMgmtApiAccessToken}' \
86+
--header 'content-type: application/json' \
87+
--data '{
88+
"refresh_token": {
89+
"expiration_type": "expiring",
90+
"rotation_type": "rotating",
91+
"token_lifetime": 31557600,
92+
"idle_token_lifetime": 2592000,
93+
"leeway": 0,
94+
"infinite_token_lifetime": false,
95+
"infinite_idle_token_lifetime": false,
96+
"policies": [
97+
{
98+
"audience": "https://{yourDomain}/me/",
99+
"scope": [
100+
"create:me:connected_accounts"
101+
]
102+
}
103+
]
104+
}
105+
}'
106+
```
107+
108+
5. Grant access to My Account API from your application
109+
- In order to grant access, use the [Application Access to APIs](https://auth0.com/docs/get-started/applications/application-access-to-apis-client-grants) feature, by creating a client grant for user flows.
110+
111+
```shell
112+
curl --location 'https://{yourDomain}/api/v2/client-grants' \
113+
--header 'Content-Type: application/json' \
114+
--header 'Authorization: Bearer {YOUR_MANAGEMENT_API_TOKEN}' \
115+
--data '{
116+
"client_id": "{CLIENT_ID}",
117+
"audience": "https://{yourDomain}/me/",
118+
"scope": [
119+
"create:me:connected_accounts"
120+
],
121+
"subject_type": "user"
122+
}'
123+
```
75124

76-
4. Configure a Social Connection for Google in Auth0
125+
6. Configure a Social Connection for Google in Auth0
77126
- Make sure to enable all `Calendar` scopes from the Permissions options
78127
- Make sure to enable the "Use for Connected Accounts with Token Vault" toggle
79128
- Make sure to enable the connection for your SPA Application created in Step 1 and the Custom API Client created in Step 3

0 commit comments

Comments
 (0)