Authentication and Authorization

Overview

Authentication and Authorization work together to secure API access.

• Authentication verifies the identity of a user or application.

• Authorization determines what the authenticated user or application is allowed to access.

Authentication

Authentication is the process of proving your identity.

For API integrations, authentication is performed using OAuth 2.0 Client Credentials, where an application presents its Client ID and Client Secret to obtain an access token.

If the credentials are valid, an access token is issued.

To get authentication token in our APIs, request using this URL:

https://api.cac.gb.apim.manulife.io/ext/opaque-oauth

Authorization

Authorization determines whether an authenticated application is allowed to access a specific API. When an application sends an API request, it includes the access token in the request header.

Authorization: Bearer <access_token>

If the token is valid, access is granted. Otherwise, the request is rejected.

How OAuth 2.0 Works

OAuth 2.0 is the authorization framework used to secure API access.

The access token acts as a temporary access credential that proves the application has been authenticated and authorized to access the API.

Developer Portal API Testing

The Developer Portal simplifies API testing by automatically generating and managing access tokens on your behalf. This allows you to focus on exploring and testing API functionality without manually obtaining or configuring OAuth tokens.

Common Errors

401 Unauthorized

The access token is missing, invalid, or expired.

403 Forbidden

The application is authenticated but does not have permission to access the requested API.