Access token and OAuth protocol

An access token is a very small piece of code that contains security credentials for a login session. Information about the user, privileges, group, and timeframes is embedded within one token that passes from a server to a user’s application or website.

OAuth is the REST open standard framework that allows an application or service to obtain limited access to a protected HTTP source.

 

What Is OAuth Token Create REST API

The OAuth Token Create API is Sabre method to generate an ATK access token (Sessionless token) that allows customers to access REST API portfolio. Once a token is generated, Sabre keeps the session opened for 7 days (604800 seconds).

We recently released OAuth Token v3, that introduces Client ID (client_ID and client_secret) parameter as an addition to user credentials (EPR/PCC and Password) .  

 

What is Client ID

Client ID is a new parameter used to track customer APIs traffic per application. Customers using multiple applications will benefit from this new feature as it allows to easily individualize the traffic generated from each of them.

Once implemented, Client ID propagates to all additional APIs and does not need to be integrated again.

Adopting the Client ID into your application enables Sabre to gather better insights for faster troubleshooting and support through:

• Ability to trace traffic to Sabre by customer and application
• Ability to trace types of Sabre APIs being called
• Ability to communicate quicker and more accurately to customers

You can find additional information about Client ID and its benefits here.

If you are not familiar with some concepts mentioned in this article like EPR, IPCC, etc. you can find detailed information here.

 

How to obtain a Client ID and Client Secret:

This is a very simple process, Webservices subscribers can request Client ID/Client Secret through their accounting teams.

 

How to setup OAuth V3 method:

As per OAuth specifications the recommendation is to define Client Credentials in the header and User Credentials in the body. For this example, we imported the yaml file to Postman client application to generate the OAuth Token Create REST API method and filed the parameters based on the above recommendation. The steps are the following:

 

A – Import the API as a new project

1. copy the link from Dev Studio OAuth Token Create REST API page

2. click on “Import”
3. click on the “link” tab
4. paste the URL in the text box
5. click on “Continue”

This will create a generic request as shown below:

 

B - Now we need to fill the values based on our own credentials:

 To define client credentials in the header, add the Content-Type and the Authorization.

Content-Type: application/x-www-form-urlencoded

Authorization: Basic base64(client_id:client_secret)

Quick note: the above “authorization value” M0NER*****************ZBVEtN is the result of encoding  client_id:client_secret as described below:

Steps	Description	Format
Step 1: Build your Client ID	Build your "Authorization" header following the standard basic authentication pattern.	clientId:clientSecret
Step 2: Base64-encode your clientId/clientSecret pair	Use a base64 encoding tool to encode your Client ID from step 1.	Y2xpZW50SWQ6Y2xpZW50U2VjcmV0

Keep in mind that in v2 this process is different, credentials are encoded in 2 steps (User and pass separately and then re-encoding the result).

 

C – Defining User Credentials In the body:

grant_type: password

username:  EPR-PCC-AA

password: EPR_password

 

I hope you find the above information useful. If you have any questions or want to learn more about Client ID, please visit the Client ID guide.