Lattice supports two authentication methods: OAuth 2.0 client credentials using short-lived access token, environment token authentication, using long-lived, static access tokens.
OAuth 2.0 client credentials exchange a client ID and secret for a short-lived token. REST SDKs manage the client credential lifecycle automatically, while gRPC integrations require that you refresh the token:
The following steps show how to authenticate using both client credentials and long-lived environment tokens with both REST and gRPC SDKs.
To store the Lattice endpoint as a system environment variable, do the following:
To store your credentials as system environment variables, do the following:
If you’re connecting to Sandboxes:
This is required for Sandboxes whether you use client credentials, or an environment token. If you do not have a Sandboxes token, create a new token.
OAuth 2.0 client credentials is the recommended authentication method for production integrations. When you use OAuth, Lattice exchanges your credentials for a short-lived access token using the Lattice OAuth REST endpoint:
The REST SDK handles fetching a new access token automatically. Pass your client ID and secret when you initialize the client:
Since gRPC does not provide built-in OAuth token management, implement a ClientCredentialsAuth
module that fetches an access token, caches it, and refreshes it before it expires:
Then, use this module to handle fetching new tokens when you interact with Lattice:
These examples refresh the access token before it expires (with a buffer of approximately five minutes). Each gRPC call invokes the helper function, which checks the cache and refreshes the token if needed.
Bearer token authentication uses a long-lived, static token to authenticate requests. Use this method when your deployment provides a static access token rather than OAuth 2.0 client credentials.
Pass the token directly to the client constructor using the token parameter:
For gRPC, attach the bearer token as metadata on every outgoing request. Most gRPC client libraries provide a credentials or interceptor mechanism for this purpose: