Authentication Guide

Autodesk Platform Services (APS) uses OAuth 2.0 for authentication. Depending on your use case, you will use one of two authentication flows:

2-Legged OAuth (Client Credentials)

Use 2-legged authentication when your application accesses resources on its own behalf, without a user context. This is common for server-to-server integrations and background processing.

curl -X POST \
  'https://developer.api.autodesk.com/authentication/v2/token' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=client_credentials&client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET&scope=data:read data:write'

3-Legged OAuth (Authorization Code)

Use 3-legged authentication when your application needs to act on behalf of a specific user. This requires the user to grant consent via a browser redirect.

Step 1: Redirect the user to the authorization URL:

https://developer.api.autodesk.com/authentication/v2/authorize?response_type=code&client_id=YOUR_CLIENT_ID&redirect_uri=YOUR_CALLBACK_URL&scope=data:read data:write

Step 2: Exchange the authorization code for an access token:

curl -X POST \
  'https://developer.api.autodesk.com/authentication/v2/token' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=authorization_code&code=AUTH_CODE&client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET&redirect_uri=YOUR_CALLBACK_URL'

Choosing the Right Flow

For more details, see the Authentication API documentation.