# OAuth2 Authentication

Askara API uses OAuth2 to secure communications between third-party applications and Askara.

## Overview

OAuth2 provides secure, delegated access to Askara resources without sharing user credentials. The framework supports multiple authentication flows depending on your application type.

## Supported Flows

### Authorization Code Flow

Recommended for server-side applications and cloud-based software. This flow provides the highest level of security as the client secret never leaves your server.

**Use cases:**

- Web applications
- Cloud-based software
- Server-to-server integrations


[→ Authorization Code Flow Guide](/guides/authorization-code-flow)

### Refresh Token Flow

Used to obtain new access tokens without re-authenticating users. Access tokens expire after 1 hour for security purposes.

[→ Refresh Token Flow Guide](/guides/refresh-token-flow)

### Device Code Flow

Designed for client-server applications or offline software where secure storage of credentials is challenging.

**Use cases:**

- Desktop applications
- Offline medical practice management software
- Devices with limited input capabilities


[→ Device Code Flow Guide](/guides/device-code-flow)

## Prerequisites

Before integrating OAuth2:

1. **Client Credentials**: Contact us to obtain your `client_id` and `client_secret`
2. **Redirect URI**: Provide the callback URL for your application
3. **Scopes**: Determine which API scopes your application requires


## Security Best Practices

- **Never expose client secrets** in client-side code or version control
- **Validate state parameters** to prevent CSRF attacks
- **Store refresh tokens securely** in encrypted database storage
- **Implement token rotation** by updating refresh tokens after each use
- **Use HTTPS only** for all OAuth2 endpoints


## Token Management

### Access Token

- **Lifetime**: 1 hour
- **Type**: JWT (JSON Web Token)
- **Usage**: Include in API requests via `Authorization: Bearer ACCESS_TOKEN` header
- **Content**: Decode at [jwt.io](https://jwt.io/) to inspect claims


### Refresh Token

- **Lifetime**: 30 days
- **Single-use**: Each refresh generates a new token pair
- **Storage**: Securely store in your database


## Next Steps

1. Choose the appropriate flow for your application type
2. Follow the specific flow guide for implementation details
3. Test your integration in the staging environment
4. Review the [API documentation](/apis/askara-symfony/askara-api) for available endpoints


## Support

For questions or to request client credentials, [contact our team](https://www.askara.ai/en/contact).