Build OAuth 2.0 Server & API Server with Authlete + Spring Boot
Tags: oauth, security, java, spring
Published: 2024-06-03 06:13:28

---
title: "Build OAuth 2.0 Server & API Server with Authlete + Spring Boot"
published: true
description: This article explains how to build OAuth 2.0 server and API server with Authlete + Spring Boot.
tags: OAuth, Security, Java, Spring 
---

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xbzitnlbgf62w9x04qzh.png)

# Overview

This article explains how to build OAuth 2.0 server and API server with [Authlete](https://www.authlete.com/) + [Spring Boot](https://spring.io/projects/spring-boot/).

# Architecture

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/30nqkwe2usqp23m9ju01.png)

# How-to-Do

## 1. Create an Account at Authlete.

Create an Authlete account on the sign up page.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/g6ez2z4rd0d16h72bpw9.png)

Upon successful signup, you will automatically login to the service owner console.

## 2. Create & Configure Service

Click **Create Service** tab at the service owner console. This redirects you to the service creation page.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3eh9gb826wudp7c83kgl.png)

Input your service name and click **Create** button. Upon successful service creation, you will be redirected to the the service detail page, 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/su7dpe1xmdaz8ml50pjt.png)

which shows the detailed information about your service as below. Write down the API key & secret value from the service detail page.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/y43jt6ydw8ois7tblxxo.png)

## 3. Create & Configure Client

Access the client application console at the following URL in your browser:

```
https://cd.authlete.com/{YOUR-SERVICE-API-KEY}
```

Then, login to the console with your service API key and secret.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/e0ea3kmy9gvysigvkqsv.png)

Input your client name and click **Create** button.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8tjwkmdcbvjynl9k4rbb.png)

Write down **Client ID** and **Client Secret**.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5mztb00xkcr7cosvq9x0.png)

## 4. Configure & Run OAuth 2.0 Server

Run the following command to download the OAuth 2.0 server.

```bash
$ git clone https://github.com/authlete/spring-oauth-server.git
```

Navigate to spring-oauth-server directory and edit authlete.properties as below.

```
service.api_key = {YOUR-SERVICE-API-KEY} 
service.api_secret = {YOUR-SERVICE-API-SECRET}
```

Start the OAuth 2.0 server by the following command. (It uses port 8080.)

```bash
$ docker-compose up
```

## 5. Configure & Run API Server

Run the following command to download the API server.

```bash
$ git clone https://github.com/authlete/spring-resource-server.git
```

Navigate to spring-resource-server directory and edit authlete.properties as below.

```
service.api_key = {YOUR-SERVICE-API-KEY} 
service.api_secret = {YOUR-SERVICE-API-SECRET}
```

Start the API server by the following command. (It uses port 8081.)

```bash
$ docker-compose up
```

## 6. Test

### 6.1. Issue Access Token

Let’s check that the OAuth 2.0 server can issue an access token using Authorization Flow ([RFC6749](https://datatracker.ietf.org/doc/html/rfc6749)).

### 6.1.1. Authorization Request

First, access the authorization endpoint (of the OAuth 2.0 server) at the following URL in your browser.

```
http://localhost:8080/api/authorization?client_id={CLIENT-ID}&response_type=code
```

Then, an authorization page will appear.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mx2u34xhqx17aj46s1g7.png)

Enter the following dummy user information and click Authorize button.

```
User ID = john
Password = john
```

Dummy user info is defined in `/src/main/java/com/authlete/spring/server/db/UserDao.java`. Modify it as needed.

Then, you will be redirected to the redirect URL like below. Write down the value of the code parameter.

```
https://api.authlete.com/api/mock/redirection/{YOUR-SERVICE-API-KEY}?code=xxxxx...
```

### 6.1.2. Token Request

Make a token request using the authorization code as follows.

```bash
$ curl -v -X POST -d 'code={AUTHORIZATION-CODE}' -d 'client_id={CLIENT-ID}' -d 'grant_type=authorization_code' http://localhost:8080/api/token
```

A successful response is like below.

```json
{ 
  "access_token": "xxxxx", 
  "refresh_token": "xxxxx", 
  "scope": null, 
  "token_type": "Bearer", 
  "expires_in": 86400 
}
```

## 6.2. Access API

Let’s access Country API (/api/country/{country-code}) on the API server using the access token.

```bash
$ curl -v -H "Authorization: Bearer {access-token}" http://localhost:8081/api/country/JP
```

A successful response will be like below.

```json
{ 
  "name": "Japan",
  "alpha2": "JP",
  "alpha3": "JPN"
  "numeric": 392
  "currency": "JPY"
}
```

If you access the API without an access token like below,

```bash
$ curl -v http://localhost:8081/api/country/JP
```

it will return an appropriate error:

```
< HTTP/1.1 400 
< Cache-Control: no-store, no-transform
< Pragma: no-cache
< WWW-Authenticate: Bearer error="invalid_token",error_description="An access token is missing."
< Content-Length: 0
...
```

# More Info

See the following information for more details.

- [README.md](https://github.com/authlete/spring-oauth-server/blob/master/README.md) & [CUSTOMIZATION.md](https://github.com/authlete/spring-oauth-server/blob/master/doc/CUSTOMIZATION.md) of spring-oauth-server

- [README.md](https://github.com/authlete/spring-resource-server/blob/master/README.md) & [CUSTOMIZATION.md](https://github.com/authlete/spring-resource-server/blob/master/doc/CUSTOMIZATION.md) of spring-resource-server

- [Authlete Website](https://www.authlete.com/)

- [Authlete API Document](https://api.authlete.com/)

- [Spring Boot Website](https://spring.io/projects/spring-boot)