Skip to content

Authentication & Access

Credentials are managed by the Sanger Integration Hub. Contact the team to obtain your credentials.

Mechanism

Authentication is handled using the OAuth 2.0 Client Credentials flow.

To authenticate with the Sapio Studies API:

  1. Send a request to the OAuth2 token endpoint with your client_id, client_secret, and grant_type=client_credentials.
  2. Receive an OAuth2 bearer token in the response.
  3. Include the bearer token in the Authorization header of all subsequent API requests.

Example header:

Authorization: Bearer <access_token>

Example token request body:

grant_type=client_credentials
client_id=<client_id>
client_secret=<client_secret>
scope=<scope>

Obtaining Credentials

Keep credentials secret

Client credentials are sensitive. Do not commit them to source control or share them in plain text. Use a secrets manager or environment variables.

Use an OAuth client library

For token management and automatic refresh, we recommend using an OAuth-recommended client library rather than implementing the flow manually.

Token Exchange

Exchange your credentials for a bearer token by posting to the Cognito token endpoint for your target environment:

https://inthub-ppd.auth.eu-west-2.amazoncognito.com/oauth2/token

The response will include an access_token and its expires_in duration (in seconds). Tokens should be cached and refreshed before expiry.

Using the Token

Pass the token as a bearer token header on all requests to the API:

curl 'https://api.example.com/sapio/studies/v1?name=Covid+Genomics' \
--header 'Authorization: Bearer <access_token>'