GBG Developers


some text

.red { fill: #b0013a; }

Get Token

Post /authenticate/v1/connect/token

This service will accept the authorisation code from your SSO provider and exchange it for a GBG access token

Mandatory fields are highlighted
Request Body
  • client_id string

    Included for completeness, may be used in future for a second factor authentication. Should be set to 'ro.client'.

    example: ro.client
  • grant_type string

    Use the custom grant type 'id_auth'

    example: id_auth
  • client_secret string

    Included for completeness, may be used in future for a second factor authentication. Should be set to 'secret'.

    example: secret
  • scope string

    One or more registered scopes as a space separated list. If not specified, a token for all explicitly allowed scopes will be issued.

    example: api api2
  • id_token string

    a JSON web token that has been obtained from an external authentication provider

    example: eyJpc3MiOiJ0b3B0YWwuY29tIiwiZXhwIjoxNDI2NDIwODAwLCJodHRwOi8vdG9wdGFsLmNvbS9qd3RfY2xhaW1zL2lzX2FkbWluIjp0cnVlLCJjb21wYW55IjoiVG9wdGFsIiwiYXdlc29tZSI6dHJ1ZX0
  • Response


    Response Body
    • {
      • access_token string
      • expires_in integer
      • token_type string
      "access_token": null,
      "expires_in": null,
      "token_type": null

    Bad Request

    Response Body

    Server Error

    Response Body
    • cURL
    • JavaScript
    • C#
    • PHP
    • Java (Spring)
    curl -X POST \
     - H 'Content-Type: application/x-www-form-urlencoded' \
        -d 'client_id=ro.client' \
        -d 'grant_type=id_auth' \
        -d 'client_secret=secret' \
        -d 'scope=api api2' \
        -d 'id_token=eyJpc3MiOiJ0b3B0YWwuY29tIiwiZXhwIjoxNDI2NDIwODAwLCJodHRwOi8vdG9wdGFsLmNvbS9qd3RfY2xhaW1zL2lzX2FkbWluIjp0cnVlLCJjb21wYW55IjoiVG9wdGFsIiwiYXdlc29tZSI6dHJ1ZX0' \
    var data = ""
    data += "client_id=" + encodeURIComponent("ro.client");
    data += "&grant_type=" + encodeURIComponent("id_auth");
    data += "&client_secret=" + encodeURIComponent("secret");
    data += "&scope=" + encodeURIComponent("api api2");
    data += "&id_token=" + encodeURIComponent("eyJpc3MiOiJ0b3B0YWwuY29tIiwiZXhwIjoxNDI2NDIwODAwLCJodHRwOi8vdG9wdGFsLmNvbS9qd3RfY2xhaW1zL2lzX2FkbWluIjp0cnVlLCJjb21wYW55IjoiVG9wdGFsIiwiYXdlc29tZSI6dHJ1ZX0");
    var xhr = new XMLHttpRequest();
    xhr.addEventListener('readystatechange', function () {
        if (this.readyState === this.DONE) {
    });'Post', '');
    xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
    var client = new HttpClient();
    var message = new HttpRequestMessage(HttpMethod.Post, "");
    var formItems = new List<KeyValuePair<string, string>>();
    formItems.Add(new KeyValuePair<string, string>("client_id", "ro.client"));
    formItems.Add(new KeyValuePair<string, string>("grant_type", "id_auth"));
    formItems.Add(new KeyValuePair<string, string>("client_secret", "secret"));
    formItems.Add(new KeyValuePair<string, string>("scope", "api api2"));
    formItems.Add(new KeyValuePair<string, string>("id_token", "eyJpc3MiOiJ0b3B0YWwuY29tIiwiZXhwIjoxNDI2NDIwODAwLCJodHRwOi8vdG9wdGFsLmNvbS9qd3RfY2xhaW1zL2lzX2FkbWluIjp0cnVlLCJjb21wYW55IjoiVG9wdGFsIiwiYXdlc29tZSI6dHJ1ZX0"));
    var formContent = new FormUrlEncodedContent(formItems);
    message.Content = formContent;
    var response = await client.SendAsync(message);
    var responseString = await response.Content.ReadAsStringAsync();
    $url = '';
    $ch = curl_init($url);
    curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
    $data = array(
        'client_id' => 'ro.client',
        'grant_type' => 'id_auth',
        'client_secret' => 'secret',
        'scope' => 'api api2',
        'id_token' => 'eyJpc3MiOiJ0b3B0YWwuY29tIiwiZXhwIjoxNDI2NDIwODAwLCJodHRwOi8vdG9wdGFsLmNvbS9qd3RfY2xhaW1zL2lzX2FkbWluIjp0cnVlLCJjb21wYW55IjoiVG9wdGFsIiwiYXdlc29tZSI6dHJ1ZX0'
    curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    $response = curl_exec($ch);
    if (curl_errno($ch)) {
        echo 'Error:' . curl_error($ch);
    $json = json_decode($response, true);
    HttpHeaders headers = new HttpHeaders();
    MultiValueMap<String, String> body = new LinkedMultiValueMap<String, String>();
    body.add("scope","api api2");
    HttpEntity<MultiValueMap<String, String>> request = new HttpEntity<>(body, headers);
    String host = "";
    //restTemplate should be autowired via constructor of this class
    ResponseEntity<String> response = restTemplate.postForEntity(host, request, String.class);
    if (200 == response.getStatusCodeValue()){
        //DO STUFF

    Remember! Each of the marked variables should be replaced with your credentials or your chosen options.