Developer Docs / Authentication / OAuth 2.0

OAuth 2.0 Authorization

Securely authorize access to Aevum Zenth APIs across all 400+ subsidiary services using industry-standard OAuth 2.0 flows.

OAuth Service: Operational

Overview

Aevum Zenth uses OAuth 2.0 as the primary authentication mechanism for server-to-server integrations, third-party applications, and cross-divisional data sharing. Our identity platform, ZenthAuth, supports multi-tenant scoping, allowing granular permissions across Energy, Aerospace, Healthcare, Finance, and other divisions.

⚠️ Security Notice

Never expose your client_secret in client-side code or public repositories. For browser-based applications, use the Authorization Code with PKCE flow instead of Client Credentials.

Endpoints

Production endpoints for ZenthAuth OAuth 2.0 service.

https://auth.aevum-zenth.io/oauth2/authorize

https://auth.aevum-zenth.io/oauth2/token

https://auth.aevum-zenth.io/oauth2/revoke

https://auth.aevum-zenth.io/.well-known/openid-configuration

Supported Grant Types

Depending on your integration type, select the appropriate grant flow. Aevum Zenth supports the following standard grant types:

Grant Type	Use Case	Token Lifespan
`client_credentials`	Server-to-server, machine-to-machine integrations	1 hour (refreshable)
`authorization_code`	Web applications requiring user context	30 min access / 7 day refresh
`authorization_code` + PKCE	Single-page apps, mobile clients	30 min access / 7 day refresh

Client Credentials Flow

Use the Client Credentials grant for service accounts integrating with Aevum Zenth infrastructure. This flow exchanges your client_id and client_secret for an access token.

cURL

curl -X POST https:\/\/auth.aevum-zenth.io\/oauth2\/token \
-H "Content-Type: application\/x-www-form-urlencoded" \
-d "client_id=az_client_x92k7m3q..." \
-d "client_secret=az_secret_..." \
-d "grant_type=client_credentials" \
-d "scope=energy:read logistics:write"

Python

import requests

response = requests.post(
    "https:\/\/auth.aevum-zenth.io\/oauth2\/token",
    data={
        "client_id": "az_client_x92k7m3q...",
        "client_secret": "az_secret_...",
        "grant_type": "client_credentials",
        "scope": "energy:read logistics:write"
    }
)

print(response.json())

Node.js

const axios = require('axios');

const tokenResponse = await axios.post(
    'https:\/\/auth.aevum-zenth.io\/oauth2\/token',
    new URLSearchParams({
        client_id: 'az_client_x92k7m3q...',
        client_secret: 'az_secret_...',
        grant_type: 'client_credentials',
        scope: 'energy:read logistics:write'
    })
);

package main

import (
    "bytes"
    "fmt"
    "net\/http"
)

data := strings.NewReplacer(
    "client_id", "az_client_x92k7m3q...",
    "client_secret", "az_secret_...",
    "grant_type", "client_credentials",
    "scope", "energy:read",
).Replace("client_id=client_secret=grant_type=scope=")

Response

JSON

{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "energy:read logistics:write",
  "tenant_id": "az-tenant-global-01"
}

Available Scopes

Scopes define the level of access granted to your application. Request only the scopes necessary for your integration. Aevum Zenth supports cross-divisional scoping.

Scope	Division	Description
`energy:read`	Energy & Power	Read real-time grid metrics, fusion reactor status, and consumption data.
`energy:write`	Energy & Power	Configure grid loads, schedule maintenance, and update smart contracts.
`aerospace:flight_data`	Aerospace	Access satellite telemetry, orbital parameters, and flight manifests.
`healthcare:patient_data`	Health Sciences	Access protected health information (requires HIPAA compliance verification).
`finance:ledger`	Capital Group	Query distributed ledgers, execute cross-border settlements.
`logistics:write`	Logistics	Create shipments, update autonomous fleet routing.
`internal:admin`	Platform	Manage service accounts, rotate keys, view audit logs.

Security Best Practices

✅ Recommended Practices

Rotate client_secret every 90 days using the Developer Console.
Store tokens in secure memory; never persist in logs or local storage.
Use PKCE for all public clients (mobile, SPA).
Implement token refresh logic to minimize long-lived credentials.
Enable MFA for all service account owners.

Error Responses

OAuth 2.0 errors follow RFC 6749 standards. Below are common error codes returned by ZenthAuth.

Error Code	Description	Action
`invalid_client`	Authentication failed or client credentials invalid.	Verify `client_id` and `client_secret` in Console.
`invalid_grant`	Authorization code expired or already used.	Restart authorization flow.
`insufficient_scope`	Token lacks required scope for the endpoint.	Request additional scopes during token exchange.
`temporarily_unavailable`	Rate limit exceeded or service maintenance.	Retry with exponential backoff.

Need Help?

If you encounter integration issues or need elevated scope permissions, contact the Aevum Zenth Developer Support team.

Submit a Ticket → Go to Developer Console