Scopes

OAuth 2.0 has a concept of scopes, where authorization is based on limited access.

Scopes define the categories of data that can be accessed and the operations that can be performed.

In other words, an app can request one or more scopes to get access to a user’s data (or to a system’s data) but access is only granted if the app is allowed to access that data.

All API endpoints that use the Authentication Framework are protected by OAuth scopes.

The OAuth scope required for a specific API endpoint can be found in the definition for that API endpoint in the API Reference.

See the RFC for more details on scopes.

Standard OAuth scopes

OAuth’s scope values are not standardized by the RFC.

The definition of an OAuth scope is determined by each API.

Standard OpenID Connect scopes

These are the standard scopes defined by OpenID Connect.

See the claims topic for more details on claims.

• openid (required)
  • Starts an OpenID Connect flow which will return an Identity Token
• address (optional)
  • Adds the user’s address claim to the Identity Token including street_address, locality/city, region/state, and postal_code
• email (optional)
  • Adds the user’s email claim to the Identity Token
• phone (optional)
  • Adds the user’s phone number claim to the Identity Token
• profile (optional)
  • Adds the user’s basic profile claims to the Identity Token including name, family_name, given_name, middle_name, preferred_username, picture, and locale

Specific Implementations

The general concepts should apply to Jack Henry’s APIs, but specific implementations may vary.

Banno Digital Toolkit

See how the Banno Digital Toolkit handles Scopes.