# Interfacing with a web API that uses OAuth2 **URL:** \ **Category:** Ignition\ **Tags:** perspective, scripting, ignition80\ **Created:** [February 14, 2022, 4:43pm UTC](https://forum.inductiveautomation.com/t/interfacing-with-a-web-api-that-uses-oauth2/56109 "2022-02-14T16:43:24Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![mdia](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mdia/32/87599_2.png) [@mdia](https://forum.inductiveautomation.com/u/mdia)\ **Post date:** [February 14, 2022, 4:43pm UTC](https://forum.inductiveautomation.com/t/interfacing-with-a-web-api-that-uses-oauth2/56109/1 "2022-02-14T16:43:24Z")
I am trying to interface with a web API that uses OAuth2. I am having trouble running the system.net.httpGet function to get the information I need. I tried using the example on this post:[OAuth2 connections - #4 by d3h637](https://forum.inductiveautomation.com/t/oauth2-connections/12366/4), but it didn’t work. I’d appreciate it if someone who has done something like this before to share an example of how they did it. I think I just be having an issue with passing in my variables. ---
**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\ **Post date:** [February 14, 2022, 4:50pm UTC](https://forum.inductiveautomation.com/t/interfacing-with-a-web-api-that-uses-oauth2/56109/2 "2022-02-14T16:50:47Z")
Ditch `httpGet`, it’s got bad performance and extremely limited support for modern web conventions. `system.net.httpClient` is better in basically every way. [https://docs.inductiveautomation.com/display/DOC81/system.net.httpClient](https://docs.inductiveautomation.com/display/DOC81/system.net.httpClient) It won’t directly do the OAuth for you, but it will make interacting with a server (and things like manually setting cookies) much easier. Is the API you’re interacting with public/have public docs? You might be able to generate a long-lived/permanent token via some developer mechanism, and thus sidestep OAuth entirely. ---
**Author:** ![mdia](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mdia/32/87599_2.png) [@mdia](https://forum.inductiveautomation.com/u/mdia)\ **Post date:** [February 14, 2022, 5:20pm UTC](https://forum.inductiveautomation.com/t/interfacing-with-a-web-api-that-uses-oauth2/56109/3 "2022-02-14T17:20:14Z")
I'm new to all this API stuff so excuse my lack of knowledge. > [@paul-griffith](#): > > Is the API you’re interacting with public/have public docs? The interface I'm trying to interact with is called Workflow max, it's a xero product. If by public docs you mean something like these: [Getting started guide — Xero Developer](https://developer.xero.com/documentation/getting-started-guide/) [https://www.workflowmax.com/api/v3/category-methods](https://www.workflowmax.com/api/v3/category-methods) Then yes. I was able to get what I was looking for in Postman after using my client\_id, client\_secret, access\_token, re\_directURl, and scopes. However, whenever I want to generate my token, I need to login using my credentials to get that token and it expires every 30 minutes. > [@paul-griffith](#): > > You might be able to generate a long-lived/permanent token via some developer mechanism, and thus sidestep OAuth entirely. So I'm wondering how this could be done. I figured out somewhat of a workaround for the token expiration issue. I setup an OpenID Identity Provider and made it the default provider for my perspective app. So every time a user logs in to the app, a new token gets generated and I get it from perspective session.props.idpAttributes. But the next step I need to figure out is how to use that token to get the data I want. ---
**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\ **Post date:** [February 14, 2022, 5:28pm UTC](https://forum.inductiveautomation.com/t/interfacing-with-a-web-api-that-uses-oauth2/56109/4 "2022-02-14T17:28:06Z")
So, at least from a scan of the documentation, it doesn’t look like there’s any ‘developer’ mechanism - you _must_ (properly) use OAuth. Unfortunately, this is also a fairly complicated API with a tricky signature validation mechanism… I would probably start by looking at how the official Python SDK does the authentication/refresh logic: > **[GitHub - XeroAPI/xero-python: Official Xero OAuth 2.0 python SDK](https://github.com/XeroAPI/xero-python#helper-methods)** > > Official Xero OAuth 2.0 python SDK. Contribute to XeroAPI/xero-python development by creating an account on GitHub. Ideally, that code could be adapted to use `system.net.httpClient`. I haven’t looked in detail, but the official Python SDK _probably_ won’t drop directly into Ignition (though that may be worth a try). If you don’t make any headway interacting with the SDK yourself, you could also get the Java SDK and drop that into Ignition, either via a custom module or the (undocumented, unsupported) trick of dropping the .jar into `lib/gateway` or `lib/core`, so that we automatically load it. The Java API is going to be verbose and awkward to use from Jython, most likely, but should handle all the required things you need it to do. ---
**Author:** ![SBL\_MC](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/sbl_mc/32/56813_2.png) [@SBL\_MC](https://forum.inductiveautomation.com/u/SBL_MC)\ **Post date:** [February 28, 2022, 11:49am UTC](https://forum.inductiveautomation.com/t/interfacing-with-a-web-api-that-uses-oauth2/56109/5 "2022-02-28T11:49:27Z")
Hi, Did you have any success on the OAuth2 authorization? I have the same challenge ahead for a “proof of concept”. ---
**Author:** ![mdia](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mdia/32/87599_2.png) [@mdia](https://forum.inductiveautomation.com/u/mdia)\ **Post date:** [February 28, 2022, 2:33pm UTC](https://forum.inductiveautomation.com/t/interfacing-with-a-web-api-that-uses-oauth2/56109/6 "2022-02-28T14:33:20Z")
I got my access token first using postman, and then I used it in Ignition to GET other data, here’s the script I used: ```auto client_id = system.tag.read("client_id").value client_secret = system.tag.read("client_secret").value AccessToken = system.tag.read("Tokens/AccessToken").value def YourFunc(access_token): connections_url = '' client = system.net.httpClient() response = client.get(connections_url, headers = { 'Authorization': 'Bearer ' + access_token, 'Content-Type': 'application/json' }) json_response = response.json print(json_response) YourFunc(AccessToken ) ``` ---
**Author:** ![SBL\_MC](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/sbl_mc/32/56813_2.png) [@SBL\_MC](https://forum.inductiveautomation.com/u/SBL_MC)\ **Post date:** [February 28, 2022, 3:02pm UTC](https://forum.inductiveautomation.com/t/interfacing-with-a-web-api-that-uses-oauth2/56109/7 "2022-02-28T15:02:15Z")
I tried to use the RESOURCE OWNER PASSWORD CREDENTIALS GRANT TYPE from the url below, with small changes I was able to get a response in the script console. Got a lot of characters, but no access\_token. Good idea to test it out with something else for debugging. > **[OAuth 2.0 Python Sample Code | BYU Developer Portal](https://developer.byu.edu/docs/consume-api/use-api/oauth-20/oauth-20-python-sample-code)** > > These sample scripts illustrate the interaction necessary to obtain and use OAuth 2.0 access tokens. They utilize the HTTP client library Requests. Requests must be installed before these samples will run. Authorization Code Grant Type This sample... ---
**Author:** ![nminchin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/nminchin/32/6911_2.png) [@nminchin](https://forum.inductiveautomation.com/u/nminchin)\ **Post date:** [March 7, 2025, 4:47am UTC](https://forum.inductiveautomation.com/t/interfacing-with-a-web-api-that-uses-oauth2/56109/8 "2025-03-07T04:47:02Z")
@paul-griffith Can you use the new(ish) OAuth 2.0 clients integration in 8.1.24 for this purpose now? (if so, how? I've never done _anything_ with OAuth - do you just include the auth code it presumably provides into the html header when calling the http request?) > **[OAuth 2.0 Clients | Ignition User Manual](https://www.docs.inductiveautomation.com/docs/8.1/platform/security/oauth-2-clients)** > > What is OAuth 2.0? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 7, 2025, 2:07pm UTC](https://forum.inductiveautomation.com/t/interfacing-with-a-web-api-that-uses-oauth2/56109/9 "2025-03-07T14:07:07Z")
No, we've had "bring OAuth clients to scripting" on the TODO list for years but it has never managed to get prioritized. Maybe in 8.3.x... ---
**Author:** ![Chris\_Bryant](https://avatars.discourse-cdn.com/v4/letter/c/d6d6ee/32.png) [@Chris\_Bryant](https://forum.inductiveautomation.com/u/Chris_Bryant)\ **Post date:** [May 19, 2025, 8:08pm UTC](https://forum.inductiveautomation.com/t/interfacing-with-a-web-api-that-uses-oauth2/56109/10 "2025-05-19T20:08:03Z")
We are using the Sepasoft Web Services module specifically because it has OAuth2 built-in for the Consumers. Something to consider as most of our clients are deprecating the ability to use Basic Authentication for their APIs as part of their cybersecurity defense posture.