AppsSecurity & Compliance

API and machine access

OAuth clients and CLI sessions

Autessa is an OAuth 2.0 provider for your own applications: register a Public or Confidential client, send users to Autessa’s hosted sign-in page, and receive a token pair back. The Autessa CLI signs in with its own short-lived, company-scoped session, and minting credentials or changing SSO always happens in the browser, never from a script.

Start free
OAuth client · Partner PortalConfidentialSample
  1. 1Your app Sends the user to /oauth/login with client_id and redirect_uri
  2. 2Autessa Hosted sign-in page
  3. 3Your app Receives access_token, refresh_token, expires_in, token_type in the URL fragment
  4. 4Refresh / revoke Confidential clients send their secret on refresh
Client typesPublic · Confidential
CLI sign-inShort-lived, company-scoped

The problem

What problem does it solve?

A credential-minting endpoint reachable from a script is a credential-minting endpoint reachable from a stolen script. The way credentials are created matters as much as how they are used.

How it works

  1. 1

    Register a client

    API Management → OAuth Clients. Name it, choose Public (SPA or browser extension, no secret) or Confidential (server-side, secret shown once), and add redirect URIs.

  2. 2

    Send users to sign in

    Redirect to /oauth/login with your client_id and redirect_uri.

  3. 3

    Receive tokens

    access_token, refresh_token, expires_in and token_type arrive in the URL fragment. Refresh and revoke endpoints complete the lifecycle.

  4. 4

    Sign in the CLI

    autessa login mints a short-lived, tenant-scoped session, capped by your company’s maximum CLI sign-in length.

Every option

OAuth clients and CLI sessions: settings and options

SettingWhat it does
Client typePublic or Confidential. Confidential clients send their secret on refresh.
Redirect URIsWhere Autessa may send tokens.
ApprovalNew clients may need Autessa admin approval before use.
CLI sessionAbout eight hours by default with no silent refresh; admins cap the maximum.

Permissions

Who can do what?

WhoWhat they can do
Members with API accessRegister and manage OAuth clients in the browser.
The CLIList the api-keys, oauth-clients and sso commands, but run none of them.

FOR DEVELOPERS

Credentials stay in the browserbash
autessa api-keys create
 
Create a new API key (done in the web app).

What to know

  • For unattended automation, put the work on the platform (scheduled jobs, triggers, webhooks), use a poweruser key over HTTP, or use a scoped API key. Do not wrap the CLI in a cron job.

Read the docs: OAuth Clients →

Connections

How OAuth clients and CLI sessions connects to the rest of Autessa

Session controls →

Maximum CLI sign-in length.

Execution history →

Terminal-driven runs are recorded as such.

Builder platform →

The CLI, APIs and SDK.

Reports, policies and security questionnaires are on the Autessa Trust Center.

FAQ

OAuth clients and CLI sessions: questions

Can my app let users sign in with their Autessa account?

Yes. Register an OAuth client and redirect users to Autessa’s hosted /oauth/login page.

Why can’t I create an API key from the CLI?

Credential minting is kept behind a browser session on purpose, so a stolen script cannot mint new credentials.

Get started with OAuth clients and CLI sessions

Autessa acts as an OAuth 2.0 provider for your own apps, the CLI signs in with a short-lived company-scoped session, and minting credentials or changing SSO always needs a person in the browser.

Start free

Reports, policies and questionnaires live on the Autessa Trust Center.

100% customizable, code and all

Make Autessa Security & Compliance fully your own.

Use it out of the box, then change anything. Ask Autobot, Autessa’s AI builder, for a new field, screen, report, workflow or agent and it builds it into your copy of the app. Or open the code and edit it yourself. Nothing is locked: the app, its data and its code are yours.

Start free and make it yours