Generate a Thomson Reuters Account token

Call 1:
Your application gets an access token from the Thomson Reuters Account and caches it.
Call 2:
Your application calls the product API through Apigee with that token. It repeats this call for each business operation until the token is close to expiring.

Machine application (client credentials)

Your application sends a POST request to the Thomson Reuters Account token endpoint
/oauth/token
. The request includes
grant_type
set to
client_credentials
, the
client_id
and
client_secret
, and the
audience
of the API product to call.
Thomson Reuters Account validates the Client ID and Client Secret.
Thomson Reuters Account returns a signed JWT access token that's valid for 24 hours.
Your application caches the token and reuses it until shortly before it expires.
Your application calls the product API through Apigee and sends the token in the Authorization: Bearer
<access token>
header.
Apigee validates the JWT locally against the published Thomson Reuters Account signing keys and enforces your product access, scopes, and quotas.
Apigee forwards the request to the product API.
The product API sends its response to Apigee.
Apigee returns the response to your application.

curl --location 'https://auth-nonprod.thomsonreuters.com/oauth/token' \
--header 'Content-Type: application/json' \
--data '{
"client_id": "<<ClientId>>",
"client_secret": "<<Secret>>",
"audience": "https://cis-api-nonprod.thomsonreuters.com",
"grant_type": "client_credentials"
}'

curl --location 'https://auth-nonprod.thomsonreuters.com/oauth/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'client_id=<client-id>' \
--data-urlencode 'client_secret=<client-secret>' \
--data-urlencode 'audience=<audience>' \
--data-urlencode 'scope=<scope>'

Authorization header:
send the token as a bearer token, the same as today. Use Authorization: Bearer <token>. The token is now a Thomson Reuters Account (Auth0) JWT, not an Apigee opaque token.
Scopes and products:
Apigee continues to govern authorization scopes. Your token's audience maps to the products you're entitled to call.
Validation:
Apigee verifies your token locally against Thomson Reuters Account (Auth0)'s published signing keys. This change adds no extra network call or slowdown.

curl --location 'https://<product-api-endpoint>/<resource>' \
--header 'Authorization: Bearer <access-token>'

Machine application (client assertion) JWTCA

SET KEY_NAME=CERT
mkdir "%KEY_NAME%"
openssl genrsa -out "%KEY_NAME%/%KEY_NAME%.key" 2048
openssl req -new -x509 -key "%KEY_NAME%/%KEY_NAME%.key" -out "%KEY_NAME%/%KEY_NAME%.cert" -days 735
openssl rsa -in "%KEY_NAME%/%KEY_NAME%.key" -pubout -out "%KEY_NAME%/%KEY_NAME%.pub"
openssl rsa -in "%KEY_NAME%/%KEY_NAME%.key" -out "%KEY_NAME%/%KEY_NAME%.rsa.key" -traditional

Your application builds a new assertion JWT with the iss, sub, aud, iat, exp, and jti claims, and signs it with your private key.
Your application sends a POST request to the Thomson Reuters Account token endpoint
/oauth/token
. The request includes
grant_type=client_credentials
, the
client_assertion_type
, the signed
client_assertion
, and the audience of the API product to call.
Thomson Reuters Account verifies the assertion's signature with your registered public key. It rejects the request if the assertion has expired or has already been used.
Thomson Reuters Account returns a signed JWT access token that's valid for 24 hours.
Your application caches the token and reuses it until shortly before it expires.
Your application calls the product API through Apigee and sends the token in the Authorization: Bearer
<access token>
header.
Apigee validates the JWT locally against the published Thomson Reuters Account signing keys and enforces your product access, scopes, and quotas.
Apigee forwards the request to the product API.
The product API sends its response to Apigee.
Apigee returns the response to your application.

Non-PROD: https://auth-nonprod.thomsonreuters.com/oauth/token
PROD: https://auth.thomsonreuters.com/oauth/token

import uuid
from datetime import datetime, timedelta, timezone

import jwt


def generate_client_assertion():
    with open("./private_key.pem", "r", encoding="utf-8") as private_key_file:
        private_key = private_key_file.read()

    now = datetime.now(timezone.utc)
    client_id = "<client-id>"

    payload = {
        "iat": int(now.timestamp()),
        "iss": client_id,
        "sub": client_id,
        "aud": "https://auth-nonprod.thomsonreuters.com/oauth/token",
        "exp": int((now + timedelta(minutes=1)).timestamp()),
        "jti": str(uuid.uuid4()),
    }

    headers = {"alg": "RS256", "kid": "<key-id>"}

    return jwt.encode(payload, private_key, algorithm="RS256", headers=headers)


if __name__ == "__main__":
    print(generate_client_assertion())

curl --location 'https://auth-nonprod.thomsonreuters.com/oauth/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'audience=<<audience>>' \
--data-urlencode 'client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer' \
--data-urlencode 'client_assertion=<<JWT Assertion>>'

User application (authorization code)

The user selects
Sign in
in your application.
Your application generates a
PKCE code_verifier
and its
S256 code_challenge
, then redirects the user's browser to the Thomson Reuters Account authorization endpoint.
The user signs in with Thomson Reuters Account using email and password or single sign-on, with multi-factor authentication where required. If the user has more than 1 ONESOURCE profile, they select a profile.
Thomson Reuters Account redirects the browser to your registered redirect URI with an authorization code and your state value.
Your application exchanges the code at the token endpoint, sending the original
code_verifier
and the same
redirect_uri
.
Thomson Reuters Account checks the code and
code_verifier
and returns a signed JWT access token. It also returns an ID token and a refresh token if you requested them.
Your application calls product APIs through Apigee with Authorization: Bearer
<access token>
.
Apigee validates the JWT locally, enforces the token's scopes and your quotas, and forwards the request to the product API. The product API's response returns to your application through Apigee.

GET https://auth-nonprod.thomsonreuters.com/authorize
  ?response_type=code
  &client_id=<client-id>
  &redirect_uri=<url-encoded-redirect-uri>
  &scope=<scopes>
  &state=<state>
  &code_challenge=<code-challenge>
  &code_challenge_method=S256
  &max_age=<max-age>

curl --location 'https://auth-nonprod.thomsonreuters.com/oauth/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=authorization_code' \
--data-urlencode 'code=<authorization-code>' \
--data-urlencode 'redirect_uri=<redirect-uri>' \
--data-urlencode 'client_id=<client-id>' \
--data-urlencode 'code_verifier=<code-verifier>'

curl --location 'https://auth-nonprod.thomsonreuters.com/oauth/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=refresh_token' \
--data-urlencode 'refresh_token=<refresh-token>' \
--data-urlencode 'client_id=<client-id>'

Refresh:
When the access token is near expiry, use the refresh token against the token endpoint (grant_type=refresh_token) to obtain a new access token without another interactive sign-in.

Reference: access token claims