Authorization

The public API offers authorization based on the OAuth 2.0 PKCE flow.

OAuth 2.0: Proof Key for Code Exchange (PKCE)

Please consult RFC 7636 for an in-depth explanation of the OAuth PKCE flow.

// https://app.kontera.ch/api/oauth/.well-known/oauth-authorization-server
{
    "issuer": "https://app.kontera.ch",
    "authorization_endpoint": "https://app.kontera.ch/api/oauth/authorize",
    "token_endpoint": "https://app.kontera.ch/api/oauth/token",
    "revocation_endpoint": "https://app.kontera.ch/api/oauth/revoke",
    "token_endpoint_auth_methods_supported": ["none", "client_secret_basic", "client_secret_post"],
    "revocation_endpoint_auth_methods_supported": ["none", "client_secret_basic", "client_secret_post"],
    "scopes_supported": ["api:base-data:read", "api:base-data:update", "api:documents:create", "api:documents:read-exported", "api:transactions:create"],
    "response_types_supported": ["code"],
    "grant_types_supported": ["authorization_code", "refresh_token"],
    "code_challenge_methods_supported": ["S256"]
}