Authentication & Access
OAuth2
Use Antly OAuth2 for delegated third-party access backed by django-oauth-toolkit.
Antly includes django-oauth-toolkit for third-party applications that need delegated user access. Use OAuth2 when a user should authorize an external app without sharing their password or long-lived session.
The API exposes authorization and token routes at /authorize/, /token/, and the django-oauth-toolkit routes under /o/. Antly also supports a controller exchange flow for code-to-JWT handoff through system.User.exchange_oauth_code, which is authentication-exempt because it runs before a normal authenticated session exists.
Authorization-code flow
- Register the OAuth application with allowed redirect URIs.
- Redirect the user to Antly's authorize URL with
client_id,redirect_uri,response_type=code,scope, andstate. - Receive the authorization
codeat your redirect URI. - Exchange the code for tokens at the token endpoint or through the Antly exchange controller used by the app shell.
- Send JQL requests with
authenticationClass: "oauth2"when using OAuth access tokens, orjwtif your exchange returns Antly JWT tokens.
Example delegated request
1{
2 "__meta__": {
3 "schema": "model",
4 "namespace": "system.User",
5 "intent": "retrieveOne",
6 "authenticationClass": "oauth2",
7 "return": {
8 "id": null,
9 "firstName": null,
10 "lastName": null,
11 "email": null
12 }
13 },
14 "filter": {
15 "id": "me"
16 }
17}The access token authenticates the user. The JQL namespace, intent, role permissions, tenant membership, and any application-level restrictions still apply.
Choosing OAuth2 vs API keys
Use OAuth2 when the integration acts on behalf of a person and should respect that person's access. Use API applications and api_key when a trusted backend integration owns the job and should run as an application principal. See /developer/api-applications-keys and /developer/authentication-classes.