oh my.. today is Oath questions day... All due to the new alert being sent out one of my developers wants to start using OAuth 2.0 for his new ReSTlet. So I found out we need to create a new Integration Record since you cannot just add OAuth 2.0 to the existing application integration record. The question I have is the field "Redirect URI" I have no idea what this refers to. Can anyone point me in the right direction ? PLS..

are you sure about the edit thing

no s0 much.. the issue is I was unable to add AUth 2.0.. but maybe because the integration was added by a previous Admin ?

otherwise start looking at the OAuth 2.0 Authorization Code Grant Flow.

ok.. thanks for the assistance.. I will dive in and see what I come up with..

tell me how it works long term, docs suggest that the refresh token is only valid for 7 days

will do , after we successfully navigate this..

@KevinC. have you been able to make any progress on this? I am looking into it as well and from what I can tell it requires user interaction ever 7 days to get a new token which if that is the case then this is no where near as good as oauth 1.0 where the entire authentication flow can be automated and requires zero user interaction

@steven.smith unfortunately, I got pulled off on another issue and wasnt able to finish my testing.. am going to see if I can get a test config with my celigo account and see if I can get it working in an hour or so.. Unfortunately found out that celigo doesnt have an option for oath2.. will need to find a test app to test with before enlisting the developer.

@KevinC., I spent some time on this and was not able to get past step 2 in the auth process. For me, the token endpoint that needs to be called fails with a No Response error. I did find out that the browser redirect for entering your NS credentials is required though, and therefore this authentication flow is not going to work for me because my integration is completely automated and will not have a user sitting in front to enter the credentials.

yea i was trying to read on how to do that URI thing if they were mobile devices.. but just gave up for the time being. I am trying to rescue my old failthful 2009 quad core mbp.

the flow involves browsers

yeah, its too bad they dont implement one of the other flows that works on the server side without any user interaction. looks like Client Credentials Flow allows for that type of interaction

the flow is sane if they had the refresh token lasting forever and had an expiring access token

true