Token Exchange

This page describes how to request a token exchange. These authentication tokens should be used when making api requests for a single user.

Scopes

Scope	Use
`api:read`	Used to perform read-only operations for machine to machine (M2M) scenrarios.
`api:write`	Used to perform full CRUD operations for machine to machine (M2M) scenrarios.
`ui:client-onboarding`	Used for the Onboarding Client Component
`api:credit-insights:read`	Access to Read Credit Insights data
`api:profile:read`	Access to Read Profile data
`api:trade-line:read`	Access to Read Credit Line data
`consumer:<upward_consumer_id>`	Access to Read and Write data for a specific consumer

Exchanging Tokens Using The API

Once a valid token has been obtained using the Authentication API, a limited scope token can be obtained using the token exchange API. This token can be used to make requests for a specific consumer, and is safe to send to the client application/web browser as needed.

To request a token exchange send a POST to our auth server containing the access_token and requested scope.

Token Exchange Request

POST https://auth-sandbox.upwardli.com/auth/token/exchange/

Header
{
    "Authorization":"Bearer [access_token]"
}
Body
{
    "grant_type":"urn:ietf:params:oauth:grant-type:token-exchange",
    "subject_token_type":"urn:ietf:params:oauth:token-type:access_token",
    "subject_token":"[access_token]",
    "audience":"https://auth-sandbox.upwardli.com",
    "scope":"api:credit-insights:read api:profile:read api:write consumer:[upward_consumer_id]"
}

Here’s what a successful response looks like:

{
    "token_type": "Bearer",
    "expires_in": 3600,
    "access_token": "[scoped access token]",
    "scope": "api:credit-insights:read api:profile:read api:write",
    "issued_token_type": "urn:ietf:params:oauth:token-type:access_token"
}

Notes:

The audience must be for the correct Environment.
The upward_consumer_id is the Upward id that you get from the Consumer.created webhook.
The new access token is a significantly longer string than the original access token.