Three-Legged User Login
A 3-step recipe with Autodesk. We can help you get access.
Recipe · 3 steps
Three-Legged User Login
with Autodesk
Authorize a user, exchange the code for tokens, and identify the user.
- Build the Autodesk authorize redirect. The user's browser follows the 302 to the Autodesk login page and, after consent, is redirected back to redirectUri with a short-lived authorization code on the query string.
- Exchange the authorization code for an access token and a refresh token. The redirect_uri must match the one used on the authorize request exactly.
- Read the profile of the user the token was issued for. This confirms the token is three-legged and identifies the account whose data the application may now act on. Requires the user-profile:read scope.
What you'll need to have ready
- clientId: The Client ID of your APS application.
- clientSecret: The Client Secret of your APS application.
- redirectUri: The URI Autodesk redirects the user back to. Must exactly match a redirect URI registered on the APS application.
- scope: Space-separated scopes to request (e.g. "data:read user-profile:read").
- state: Opaque anti-CSRF value echoed back on the redirect.
- authorizationCode: The authorization code captured from the redirect URI query string after the user granted consent. Obtained out of band by the browser, not by the first step of
- codeVerifier: The PKCE code verifier, required only if a code_challenge was sent on the authorize request.
For your developer
Arazzo workflow autodesk:three-legged-user-login, 3 operations: authorize → getToken → getUserProfile. Specs on APIs.io.