#2. OAuth 2.0 Implementation

Connected Services Framework (CSF) — Part 2: Implementation — Version 2.0

#2.1 Overview

The CSF uses OAuth 2.0 Client Credentials flow for machine-to-machine authentication between MAPs. This is the same approach used by TOTSCo for OTS, ensuring maximum compatibility across the industry.

Each MAP operates as both:

• An OAuth 2.0 Authorisation Server — issuing tokens to other MAPs that want to access its endpoints
• An OAuth 2.0 Client — requesting tokens from other MAPs to access their endpoints

During onboarding, MAPs exchange client_id and client_secret credentials with each other.

#2.2 Access Token Request

To obtain an access token, the requesting MAP sends an HTTP POST to the target MAP's token endpoint.

Request URL: https://{fqdn}/oauth2/token

The FQDN is obtained from the oauthTokenURL field in the target MAP's registry (see Directory API).

#Request Headers

#Request Body Parameters

Note : A MAP should support client_id + client_secret in both headers and body as per OAuth 2.0 Standard

#2.3 Access Token Response

A successful request returns an HTTP 200 with the following JSON body:

{
  "access_token": "{OAuth2 Access Token}",
  "token_type": "bearer",
  "scope": "default",
  "expires_in": 3600
}

#2.4 Using the Access Token

Include the access token in the Authorization header of all API requests:

Authorization: Bearer {access_token}

The token MUST be validated by the receiving MAP on every request, checking:

• Token signature validity
• Token has not expired
• Issuer matches the expected authorisation server
• Audience/scope is appropriate for the requested resource

#2.5 Token Lifecycle

• Tokens are short-lived (typically 1 hour)
• MAPs SHOULD cache tokens and reuse them until close to expiry
• Client secrets MUST be stored securely (e.g., in environment variables or secret vaults, never in source code)
• Client secrets SHOULD be rotated periodically

#2.6 Error Responses

The following errors may be returned during token generation:

#2.7 Security Requirements