> ## Documentation Index > Fetch the complete documentation index at: https://docs-dev-docs-event-stream-action-templates.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Effectuer une requête à votre API à l’aide du Flux des identifiants client > Ce tutoriel vous aidera à appeler votre API à partir d’une application machine-machine (M-M) à l’aide du Flux des identifiants client. export const AuthCodeGroup = ({children, dropdown}) => { const [processedChildren, setProcessedChildren] = useState(children); useEffect(() => { let unsubscribe = null; function init() { unsubscribe = window.autorun(() => { const processChildren = node => { if (typeof node === "string") { let processedNode = node; for (const [key, value] of window.rootStore.variableStore.values.entries()) { const escapedKey = key.replaceAll(/[.*+?^${}()|[\]\\]/g, (String.raw)`\$&`); processedNode = processedNode.replaceAll(new RegExp(escapedKey, "g"), value); } return processedNode; } else if (Array.isArray(node)) { return node.map(processChildren); } else if (node && node.props && node.props.children) { return { ...node, props: { ...node.props, children: processChildren(node.props.children) } }; } return node; }; setProcessedChildren(processChildren(children)); }); } if (window.rootStore) { init(); } else { window.addEventListener("adu:storeReady", init); } return () => { window.removeEventListener("adu:storeReady", init); unsubscribe?.(); }; }, [children]); return {processedChildren}; }; export const AuthCodeBlock = ({filename, icon, language, highlight, children}) => { const [displayText, setDisplayText] = useState(children); const [copyText, setCopyText] = useState(children); const wrapperRef = React.useRef(null); useEffect(() => { let unsubscribe = null; function init() { if (!window.autorun || !window.rootStore) { return; } unsubscribe = window.autorun(() => { let processedChildrenForDisplay = children; let processedChildrenForCopy = children; for (const [key, value] of window.rootStore.variableStore.values.entries()) { const escapedKey = key.replaceAll(/[.*+?^${}()|[\]\\]/g, (String.raw)`\$&`); let displayValue = value; if (key === "{yourClientSecret}" && value !== "{yourClientSecret}") { displayValue = value.substring(0, 3) + "*****MASKED*****"; } processedChildrenForDisplay = processedChildrenForDisplay.replaceAll(new RegExp(escapedKey, "g"), displayValue); processedChildrenForCopy = processedChildrenForCopy.replaceAll(new RegExp(escapedKey, "g"), value); } setDisplayText(processedChildrenForDisplay); setCopyText(processedChildrenForCopy); }); } if (window.rootStore) { init(); } else { window.addEventListener("adu:storeReady", init); } return () => { window.removeEventListener("adu:storeReady", init); unsubscribe?.(); }; }, [children]); useEffect(() => { if (!wrapperRef.current) return; const originalWriteText = navigator.clipboard.writeText.bind(navigator.clipboard); let isOverriding = false; const handleClick = e => { const button = e.target.closest('[data-testid="copy-code-button"]'); if (!button || !wrapperRef.current.contains(button)) return; isOverriding = true; navigator.clipboard.writeText = text => { if (isOverriding) { isOverriding = false; navigator.clipboard.writeText = originalWriteText; return originalWriteText(copyText); } return originalWriteText(text); }; setTimeout(() => { if (isOverriding) { isOverriding = false; navigator.clipboard.writeText = originalWriteText; } }, 100); }; const wrapper = wrapperRef.current; wrapper.addEventListener('click', handleClick, true); return () => { wrapper.removeEventListener('click', handleClick, true); if (navigator.clipboard.writeText !== originalWriteText) { navigator.clipboard.writeText = originalWriteText; } }; }, [copyText]); return
{displayText}
; }; Ce tutoriel vous aidera à appeler votre API à partir d’une application machine-machine (M-M) à l’aide du Flux des identifiants client. Pour savoir comment fonctionne le flux et pourquoi vous devriez l’utiliser, consultez [Flux des identifiants client](/docs/fr-ca/get-started/authentication-and-authorization-flow/client-credentials-flow). Auth0 permet à votre application d’implémenter facilement le Flux des identifiants client. Une fois l’authentification réussie, l’application aura accès à un jeton d’accès, qui peut être utilisé pour appeler vos API protégées. Pour en savoir plus sur les jetons d’accès, lisez [Jetons d’accès](/docs/fr-ca/secure/tokens/access-tokens). ## Prérequis **Avant de commencer ce tutoriel :** * [Enregistrez votre application avec Auth0](/docs/fr-ca/get-started/auth0-overview/set-up-apis) * [Ajoutez les permissions API appropriées](/docs/fr-ca/get-started/apis/add-api-permissions) * [Enregistrez l’application machine-machine avec Auth0](/docs/fr-ca/get-started/auth0-overview/create-applications/machine-to-machine-apps). * Sélectionnez un **type d’application** pour les **Applications machine-machine**. * Choisissez votre API précédemment enregistrée. * Autorisez l’application machine-machine à appeler votre API. ## Étapes 1. [Demande de jeton](#request-tokens) : À partir de l’application autorisée, demandez un jeton d’accès pour votre API. 2. [Appel d’API](#call-api) : Utilisez le jeton d’accès récupéré pour appeler votre API. Facultatif : [Découvrez des cas d’utilisation](#sample-use-cases) ### Jetons de requête Pour accéder à votre API, vous devez demander un jeton d’accès. Pour ce faire, vous devrez faire un `POST` vers le [jeton URL](/docs/fr-ca/api/authentication#client-credentials). #### Exemple de POST à une URL de jeton ```bash cURL theme={null} curl --request POST \ --url 'https://{yourDomain}/oauth/token' \ --header 'content-type: application/x-www-form-urlencoded' \ --data grant_type=client_credentials \ --data client_id={yourClientId} \ --data client_secret={yourClientSecret} \ --data audience=YOUR_API_IDENTIFIER ``` ```csharp C# theme={null} var client = new RestClient("https://{yourDomain}/oauth/token"); var request = new RestRequest(Method.POST); request.AddHeader("content-type", "application/x-www-form-urlencoded"); request.AddParameter("application/x-www-form-urlencoded", "grant_type=client_credentials&client_id={yourClientId}&client_secret={yourClientSecret}&audience=YOUR_API_IDENTIFIER", ParameterType.RequestBody); IRestResponse response = client.Execute(request); ``` ```go Go theme={null} package main import ( "fmt" "strings" "net/http" "io/ioutil" ) func main() { url := "https://{yourDomain}/oauth/token" payload := strings.NewReader("grant_type=client_credentials&client_id={yourClientId}&client_secret={yourClientSecret}&audience=YOUR_API_IDENTIFIER") req, _ := http.NewRequest("POST", url, payload) req.Header.Add("content-type", "application/x-www-form-urlencoded") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := ioutil.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```java Java theme={null} HttpResponse response = Unirest.post("https://{yourDomain}/oauth/token") .header("content-type", "application/x-www-form-urlencoded") .body("grant_type=client_credentials&client_id={yourClientId}&client_secret={yourClientSecret}&audience=YOUR_API_IDENTIFIER") .asString(); ``` ```javascript Node.JS theme={null} var axios = require("axios").default; var options = { method: 'POST', url: 'https://{yourDomain}/oauth/token', headers: {'content-type': 'application/x-www-form-urlencoded'}, data: new URLSearchParams({ grant_type: 'client_credentials', client_id: '{yourClientId}', client_secret: '{yourClientSecret}', audience: 'YOUR_API_IDENTIFIER' }) }; axios.request(options).then(function (response) { console.log(response.data); }).catch(function (error) { console.error(error); }); ``` ```objc Obj-C theme={null} #import NSDictionary *headers = @{ @"content-type": @"application/x-www-form-urlencoded" }; NSMutableData *postData = [[NSMutableData alloc] initWithData:[@"grant_type=client_credentials" dataUsingEncoding:NSUTF8StringEncoding]]; [postData appendData:[@"&client_id={yourClientId}" dataUsingEncoding:NSUTF8StringEncoding]]; [postData appendData:[@"&client_secret={yourClientSecret}" dataUsingEncoding:NSUTF8StringEncoding]]; [postData appendData:[@"&audience=YOUR_API_IDENTIFIER" dataUsingEncoding:NSUTF8StringEncoding]]; NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:[NSURL URLWithString:@"https://{yourDomain}/oauth/token"] cachePolicy:NSURLRequestUseProtocolCachePolicy timeoutInterval:10.0]; [request setHTTPMethod:@"POST"]; [request setAllHTTPHeaderFields:headers]; [request setHTTPBody:postData]; NSURLSession *session = [NSURLSession sharedSession]; NSURLSessionDataTask *dataTask = [session dataTaskWithRequest:request completionHandler:^(NSData *data, NSURLResponse *response, NSError *error) { if (error) { NSLog(@"%@", error); } else { NSHTTPURLResponse *httpResponse = (NSHTTPURLResponse *) response; NSLog(@"%@", httpResponse); } }]; [dataTask resume]; [dataTask resume]; ``` ```php PHP theme={null} $curl = curl_init(); curl_setopt_array($curl, [ CURLOPT_URL => "https://{yourDomain}/oauth/token", CURLOPT_RETURNTRANSFER => true, CURLOPT_ENCODING => "", CURLOPT_MAXREDIRS => 10, CURLOPT_TIMEOUT => 30, CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1, CURLOPT_CUSTOMREQUEST => "POST", CURLOPT_POSTFIELDS => "grant_type=client_credentials&client_id={yourClientId}&client_secret={yourClientSecret}&audience=YOUR_API_IDENTIFIER", CURLOPT_HTTPHEADER => [ "content-type: application/x-www-form-urlencoded" ], ]); $response = curl_exec($curl); $err = curl_error($curl); curl_close($curl); if ($err) { echo "cURL Error #:" . $err; } else { echo $response; } ``` ```python Python theme={null} import http.client conn = http.client.HTTPSConnection("") payload = "grant_type=client_credentials&client_id={yourClientId}&client_secret={yourClientSecret}&audience=YOUR_API_IDENTIFIER" headers = { 'content-type': "application/x-www-form-urlencoded" } conn.request("POST", "/{yourDomain}/oauth/token", payload, headers) res = conn.getresponse() data = res.read() print(data.decode("utf-8")) ``` ```ruby Ruby theme={null} require 'uri' require 'net/http' require 'openssl' url = URI("https://{yourDomain}/oauth/token") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true http.verify_mode = OpenSSL::SSL::VERIFY_NONE request = Net::HTTP::Post.new(url) request["content-type"] = 'application/x-www-form-urlencoded' request.body = "grant_type=client_credentials&client_id={yourClientId}&client_secret={yourClientSecret}&audience=YOUR_API_IDENTIFIER" response = http.request(request) puts response.read_body ``` ```swift Swift theme={null} import Foundation let headers = ["content-type": "application/x-www-form-urlencoded"] let postData = NSMutableData(data: "grant_type=client_credentials".data(using: String.Encoding.utf8)!) postData.append("&client_id={yourClientId}".data(using: String.Encoding.utf8)!) postData.append("&client_secret={yourClientSecret}".data(using: String.Encoding.utf8)!) postData.append("&audience=YOUR_API_IDENTIFIER".data(using: String.Encoding.utf8)!) let request = NSMutableURLRequest(url: NSURL(string: "https://{yourDomain}/oauth/token")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "POST" request.allHTTPHeaderFields = headers request.httpBody = postData as Data let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ``` ##### Paramètres | Nom du paramètre | Description | | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `grant_type` | Définissez sur « client\_credentials ». | | `client_id` | L’ID client de votre application. Vous pouvez trouver cette valeur dans [l’onglet des paramètres de l’application](https://manage.auth0.com/#/applications). | | `client_secret` | Le secret client de votre application. Vous pouvez trouver cette valeur dans [l’onglet des paramètres de l’application](https://manage.auth0.com/#/applications). Pour en savoir plus sur les méthodes d’authentification des applications disponibles, veuillez consulter [Informations d’identification de l’application ](/docs/fr-ca/secure/application-credentials). | | `audience` | L’audience du jeton, qui est votre API. Vous pouvez le trouver dans le champ **Identifier** de votre [onglet Paramètres de l’API](https://manage.auth0.com/#/apis). | | `organization` | Facultatif. Le nom de l’organisation ou l’identifiant auquel vous souhaitez que la demande soit associée. Pour en savoir plus, lisez [Accès de communication entre machines pour les Organizations](/docs/fr-ca/manage-users/organizations/organizations-for-m2m-applications). | #### Réponse Si tout se passe bien, vous recevrez une réponse `HTTP 200` avec une charge utile contenant les valeurs `access_token`, `token_type` et `expires_in` ```json lines theme={null} { "access_token":"eyJz93a...k4laUWw", "token_type":"Bearer", "expires_in":86400 } ``` Validez vos jetons avant de les enregistrer. Pour en savoir plus, lisez [Valider les jetons d’ID](/docs/fr-ca/secure/tokens/id-tokens/validate-id-tokens) et [Valider les jetons d’accès](/docs/fr-ca/secure/tokens/access-tokens/validate-access-tokens). ### Appel d’API Pour appeler votre API à partir de l’application machine-machine (M2M), l’application doit transmettre le jeton d’accès récupéré en tant que jeton du porteur dans l’en-tête Authorization de votre requête HTTP. ```bash cURL lines theme={null} curl --request GET \ --url https://myapi.com/api \ --header 'authorization: Bearer ACCESS_TOKEN' \ --header 'content-type: application/json' ``` ```csharp C# lines theme={null} var client = new RestClient("https://myapi.com/api"); var request = new RestRequest(Method.GET); request.AddHeader("content-type", "application/json"); request.AddHeader("authorization", "Bearer ACCESS_TOKEN"); IRestResponse response = client.Execute(request); ``` ```go Go lines expandable theme={null} package main import ( "fmt" "net/http" "io/ioutil" ) func main() { url := "https://myapi.com/api" req, _ := http.NewRequest("GET", url, nil) req.Header.Add("content-type", "application/json") req.Header.Add("authorization", "Bearer ACCESS_TOKEN") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := ioutil.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```java Java lines theme={null} HttpResponse response = Unirest.get("https://myapi.com/api") .header("content-type", "application/json") .header("authorization", "Bearer ACCESS_TOKEN") .asString(); ``` ```javascript Node.JS lines theme={null} var axios = require("axios").default; var options = { method: 'GET', url: 'https://myapi.com/api', headers: {'content-type': 'application/json', authorization: 'Bearer ACCESS_TOKEN'} }; axios.request(options).then(function (response) { console.log(response.data); }).catch(function (error) { console.error(error); }); ``` ```objc Obj-C lines theme={null} #import NSDictionary *headers = @{ @"content-type": @"application/json", @"authorization": @"Bearer ACCESS_TOKEN" }; NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:[NSURL URLWithString:@"https://myapi.com/api"] cachePolicy:NSURLRequestUseProtocolCachePolicy timeoutInterval:10.0]; [request setHTTPMethod:@"GET"]; [request setAllHTTPHeaderFields:headers]; NSURLSession *session = [NSURLSession sharedSession]; NSURLSessionDataTask *dataTask = [session dataTaskWithRequest:request completionHandler:^(NSData *data, NSURLResponse *response, NSError *error) { if (error) { NSLog(@"%@", error); } else { NSHTTPURLResponse *httpResponse = (NSHTTPURLResponse *) response; NSLog(@"%@", httpResponse); } }]; [dataTask resume]; ``` ```php PHP lines expandable theme={null} $curl = curl_init(); curl_setopt_array($curl, [ CURLOPT_URL => "https://myapi.com/api", CURLOPT_RETURNTRANSFER => true, CURLOPT_ENCODING => "", CURLOPT_MAXREDIRS => 10, CURLOPT_TIMEOUT => 30, CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1, CURLOPT_CUSTOMREQUEST => "GET", CURLOPT_HTTPHEADER => [ "authorization: Bearer ACCESS_TOKEN", "content-type: application/json" ], ]); $response = curl_exec($curl); $err = curl_error($curl); curl_close($curl); if ($err) { echo "cURL Error #:" . $err; } else { echo $response; } ``` ```python Python lines theme={null} import http.client conn = http.client.HTTPSConnection("myapi.com") headers = { 'content-type': "application/json", 'authorization': "Bearer ACCESS_TOKEN" } conn.request("GET", "/api", headers=headers) res = conn.getresponse() data = res.read() print(data.decode("utf-8")) ``` ```ruby Ruby lines theme={null} require 'uri' require 'net/http' require 'openssl' url = URI("https://myapi.com/api") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true http.verify_mode = OpenSSL::SSL::VERIFY_NONE request = Net::HTTP::Get.new(url) request["content-type"] = 'application/json' request["authorization"] = 'Bearer ACCESS_TOKEN' response = http.request(request) puts response.read_body ``` ```swift Swift lines theme={null} import Foundation let headers = [ "content-type": "application/json", "authorization": "Bearer ACCESS_TOKEN" ] let request = NSMutableURLRequest(url: NSURL(string: "https://myapi.com/api")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "GET" request.allHTTPHeaderFields = headers let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ``` ### Exemples de cas d’utilisation #### Personnalisation des jetons Vous pouvez utiliser des [Actions](/docs/fr-ca/customize/actions) pour refuser des jetons d’accès sur la base d’une logique personnalisée et/ou ajouter des demandes aux jetons d’accès. Auth0 invoque les actions liées à l’octroi des identifiants du client au moment de l’exécution pour exécuter votre logique personnalisée. Pour en savoir plus sur les actions, lisez [Flux machine-machine](/docs/fr-ca/customize/actions/explore-triggers/machine-to-machine-trigger). #### Consultez un exemple d’application serveur client + API Pour un exemple de mise en œuvre, consultez le scénario d’architecture [Serveur Client + API](/docs/fr-ca/architecture-scenarios/application/server-api). Cette série de tutoriels est accompagnée d’un [exemple de code que vous pouvez consulter sur GitHub](https://github.com/auth0-samples/auth0-pnp-exampleco-timesheets). Une fois que votre API a reçu une demande avec un jeton d’accès, elle doit valider le jeton. Pour en savoir plus, consultez [Valider les jetons d’accès](/docs/fr-ca/secure/tokens/access-tokens/validate-access-tokens). ## En savoir plus * [Déclencheur machine à machine](/docs/fr-ca/customize/actions/explore-triggers/machine-to-machine-trigger) * [Protocole OpenID Connect](/docs/fr-ca/authenticate/protocols/openid-connect-protocol) * [Jetons](/docs/fr-ca/secure/tokens)