Request OAuth authorization (Client credentials)

Applications request authorization for access to a company from the company's OAuth token endpoint, which is a URL in this format: https://instance.medallia.com/oauth/companyName/token. For example, https://queryapidemo.demo.sc4.medallia.com/oauth/myCompany/token.

When requesting the token, pass in the client ID and secret values as username and password arguments when making the request.

cURL example

For curl, use this template:

curl <TOKEN_URL> -X POST -u 'CLIENT_ID:CLIENT_SECRET' -d grant_type=client_credentials

For example, in this curl invocation the Client ID and Client secret are querydemo and query12345:

curl https://queryapidemo.demo.sc4.medallia.com/oauth/fs/token -X POST -u 'querydemo:query12345' -d grant_type=client_credentials

Alternatively, you can use this template to specify each value as a data element:

curl <TOKEN_URL> -X POST -d client_id=CLIENT_ID -d client_secret=CLIENT_SECRET -d grant_type=client_credentials

In which case the example looks like this:

curl https://queryapidemo.demo.sc4.medallia.com/oauth/fs/token -X POST -d client_id=querydemo -d client_secret=query12345' -d grant_type=client_credentials

Java client example

This Java example uses the Google OAuth client to pass client ID (key) and secret to the endpoint to request a bearer token. The Client ID and Client secret are querydemo and query12345:

1. Add Google Gradle dependencies to your build.gradle project file:

   compile 'com.google.oauth-client:google-oauth-client:1.23.0'
   compile 'com.google.http-client:google-http-client-jackson2:1.23.0'

2. Obtain an access token by authenticating to the corresponding token endpoint:

   import com.google.api.client.auth.oauth2.BearerToken;
   import com.google.api.client.auth.oauth2.ClientCredentialsTokenRequest;
   import com.google.api.client.auth.oauth2.ClientParametersAuthentication;
   import com.google.api.client.auth.oauth2.Credential;
   import com.google.api.client.auth.oauth2.TokenResponse;
   import com.google.api.client.http.GenericUrl;
   import com.google.api.client.http.HttpRequestFactory;
   import com.google.api.client.http.HttpResponse;
   import com.google.api.client.http.javanet.NetHttpTransport;
   import com.google.api.client.json.jackson2.JacksonFactory;
   
   import java.io.IOException;
   
   public class SampleApplication {
   
       public static void main(String[] args) throws IOException {
           String accessToken = getAccessToken("https://queryapidemo.demo.sc4.medallia.com/oauth/fs/token", 
                                               "querydemo", "query12345");
           System.out.println("Access token: " + accessToken);
       }
   
       private static String getAccessToken(String tokenUrl, String clientId, String clientSecret) throws IOException {
       TokenResponse response =
          new ClientCredentialsTokenRequest(
              new NetHttpTransport(),
              new JacksonFactory(),
              new GenericUrl(tokenUrl))
              .setGrantType("client_credentials")
              .setClientAuthentication(
              new ClientParametersAuthentication(
                  clientId, clientSecret))
              .execute();
   
       return response.getAccessToken();
   
   }

   Once you have obtained an access token, you can use it to request resources. For more information, see Make an API call using the access (bearer) token.

Authorization code flow

Some Medallia Experience Cloud APIs require a token that must be requested using the Authorization code Grant and requesting an OpenID token. The Authorization Code Flow involves exchanging an authorization code for a token. For more information see section 4.1 of the OAuth 2.0 authorization framework.

Experience Cloud uses this grant type to obtain both an access token and an ID token.

This is a redirection based grant, redirect URIs must be configured manually. This URI will be used when requesting a code to exchange for a token.

Request OAuth authorization (Authorization code grant)

Applications request authorization for access to a company from the company's OAuth authorization endpoint, which is a URL in this format: https://instance.medallia.com/oauth/companyName/authorize.

For example, https://queryapidemo.demo.sc4.medallia.com/oauth/myCompany/authorize.

Follow the steps below to receive both the access token and the ID token.

For information on how to use these tokens, see Use the access token and ID token.