Authentication

Egnyte uses OAuth 2.0 for authentication. Before making API calls, you must obtain an access token and include it in the Authorization header of all subsequent requests.

Egnyte supports multiple OAuth 2.0 flows depending on your application type:

• Public applications (partner integrations): Use Authorization Code or Implicit Grant
• Internal applications (customer-built): Use Resource Owner Password Credentials
• Token refresh: Use Refresh Token Flow to obtain new tokens without user interaction

Token Lifecycle

• Access tokens expire after 30 days
• Refresh tokens can be used to obtain new access/refresh token pairs without user interaction
• Tokens are immediately revoked if a user changes their password or explicitly revokes access
• Your application must handle 401 Unauthorized responses and use the refresh token to obtain new credentials

Using Access Tokens

Include the access token in the Authorization header of every API request:

Authorization: Bearer 68zc95e3xv954u6k3hbnma3q

Example Request

curl -i -X GET "https://{domain}.egnyte.com/pubapi/v1/userinfo" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

Public Applications

Public applications are built by Egnyte partners for use by multiple customers. Use either the Authorization Code flow (recommended for server-side apps) or Implicit Grant flow (for browser-only apps).

Authorization Code Flow

The Authorization Code flow is the recommended approach for applications with a server-side component. Tokens are stored securely in your backend and never exposed to the browser.

Step 1: Initiate the Authentication Flow

Redirect the user to the Egnyte OAuth authorization page:

https://{domain}.egnyte.com/puboauth/token?client_id={API_Key}&redirect_uri={Callback_URL}&scope={SCOPES}&state={STATE}&response_type=code

Query Parameters

*While technically optional, all third-party applications must scope token requests. Applications will not be approved for production without proper scoping.

Example Request

https://apidemo.egnyte.com/puboauth/token?client_id=x2g35g8gynb5cedas649m4h4&redirect_uri=https://yourapp.com/oauth&scope=Egnyte.filesystem%20Egnyte.link&state=apidemo123&response_type=code

The user will see an authorization page displaying your application information and requesting permission to access their Egnyte account.

Step 2: Handle the Authorization Response

On approval, Egnyte redirects to:

https://yourapp.com/oauth?code=5u3m26mzgfn8nv6antmessr5&state=apidemo123

On denial, Egnyte redirects to:

https://yourapp.com/oauth?error=access_denied&state=apidemo123

Step 3: Exchange the Code for a Token

Make a POST request to exchange the authorization code for an access token:

POST /puboauth/token

Request Body (form-encoded)

Send as application/x-www-form-urlencoded:

Example Request

curl -i -X POST "https://{domain}.egnyte.com/puboauth/token" \
     -H "Content-Type: application/x-www-form-urlencoded" \ \
     -d 'client_id={client_id}&client_secret={client_secret}&redirect_uri={redirect_uri}&code={authorization_code}&grant_type=authorization_code'

Response

200 OK

Example Response

{
  "access_token": "68zc95e3xv954u6k3hbnma3q",
  "refresh_token": "46zc95e3xv954u6k3hbnma3f",
  "token_type": "bearer",
  "expires_in": 2592000
}

Store both tokens securely and encrypted. Never expose them in browser storage.

Enhanced Authentication Service

The Enhanced Authentication Service simplifies the Authorization Code flow by eliminating the need to know the user's Egnyte domain upfront. The user is prompted to provide their domain during the OAuth flow.

Base URLs

Initiate Enhanced OAuth Flow

Redirect the user to:

{baseUrl}/oauth/code?redirect_uri={clientUri}&client_id={apiKey}&state={state}

The flow redirects to your clientUri with an authorization code. The user's chosen domain is available in the Referer header.

Skip Domain Selection

If you already know the user's domain, skip the domain selection step by adding the domain parameter:

{baseUrl}/oauth/code?redirect_uri={clientUri}&client_id={apiKey}&domain=apidemo.egnyte.com&state={state}

Example Request

https://partner-integrations.egnyte.com/services/oauth/code?redirect_uri=https://example.com/&client_id=x2g35g8gynb5cedas649m4h4&state=STATE

Example Response

Redirects to:

https://example.com/?state=STATE&code=st6b9tzzz5ck48x5yyauswv3

Retrieve the Egnyte domain from the Referer header in the final redirect.

Implicit Grant Flow

The Implicit Grant flow is designed for browser-based applications that cannot securely store a client secret. The access token is returned directly in the URL fragment.

Step 1: Initiate the Authentication Flow

Redirect the user to:

https://{domain}.egnyte.com/puboauth/token?client_id={API_Key}&redirect_uri={Callback_URL}&scope={SCOPES}&state={STATE}&response_type=token

Query Parameters

*Required for production approval.

Example Request

https://apidemo.egnyte.com/puboauth/token?client_id=x2g35g8gynb5cedas649m4h4&redirect_uri=https://yourapp.com/oauth&scope=Egnyte.filesystem%20Egnyte.link&state=apidemo123&response_type=token

Step 2: Handle the Response

On approval, Egnyte redirects to:

https://yourapp.com/oauth#access_token=68zc95e3xv954u6k3hbnma3q&token_type=bearer&state=apidemo123

On denial, Egnyte redirects to:

https://yourapp.com/oauth#error=access_denied&state=apidemo123

Internal Applications

Internal applications are built by Egnyte customers for use within their own organization. Use the Resource Owner Password Credentials flow to obtain tokens.

Resource Owner Password Credentials Flow

This flow allows internal applications to obtain tokens by exchanging user credentials directly.

Request

POST /puboauth/token

Request Body (form-encoded)

Send as application/x-www-form-urlencoded:

*Required if your key was issued after January 2015.

Example Request (cURL)

curl -i -X POST "https://{domain}.egnyte.com/puboauth/token" \
     -H "Content-Type: application/x-www-form-urlencoded" \ \
     -d 'client_id={client_id}&client_secret={client_secret}&username={username}&password={password}&grant_type=password'

Response

200 OK

Example Response

{
  "access_token": "68zc95e3xv954u6k3hbnma3q",
  "refresh_token": "46zc95e3xv954u6k3hbnma3f",
  "token_type": "bearer",
  "expires_in": 2592000
}

OAuth Scopes

OAuth scopes restrict a token's access to specific APIs. By default, tokens have global access to all APIs. You should always scope tokens to only the APIs your application needs.

Specifying Scopes

Pass the scope parameter as a space-delimited list:

scope=Egnyte.filesystem Egnyte.link

For Authorization Code and Implicit Grant flows, include scope in the query string. For Resource Owner flow, include it in the form-encoded request body.

Available Scopes

User-Facing Scope Display

When using public application flows, users see a list of permissions based on requested scopes. Requesting only necessary scopes increases the likelihood of user approval.

Example: No scopes specified

The authorization dialog shows:

Example: Scoped request

scope=Egnyte.filesystem Egnyte.link

The dialog shows only relevant permissions for File System and Links APIs.

Get User Info for an OAuth Token

Retrieve user information associated with a given OAuth token.

Request

GET /pubapi/v1/userinfo

Example Request (cURL)

curl -i -X GET "https://{domain}.egnyte.com/pubapi/v1/userinfo" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

Response

200 OK

Example Response

{
  "id": 123,
  "first_name": "Test",
  "last_name": "User",
  "username": "test"
}

Revoke an OAuth Token

Revoke access for an OAuth token. Revoking an access token also revokes its associated refresh token.

Request

POST /pubapi/v1/tokens/revoke

Request Body (form-encoded)

Send as application/x-www-form-urlencoded:

Example Request (cURL)

curl -i -X POST "https://{domain}.egnyte.com/pubapi/v1/tokens/revoke" \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
     -d 'token={access_token}&client_secret={client_secret}'

Response

200 OK

Returns an empty response body on success.

Refresh Token Flow

Use the Refresh Token flow to obtain a new access token without requiring user interaction. This allows your application to maintain continuous access after the initial access token expires.

Step 1: Request New Tokens

POST /puboauth/token

Request Body (form-encoded)

Send as application/x-www-form-urlencoded:

Example Request (cURL)

curl -i -X POST "https://{domain}.egnyte.com/puboauth/token" \
     -H "Content-Type: application/x-www-form-urlencoded" \ \
     -d 'client_id={client_id}&client_secret={client_secret}&grant_type=refresh_token&refresh_token={refresh_token}'

Step 2: Handle the Response

On success, Egnyte returns a new access and refresh token pair:

{
  "access_token": "68zc95e3xv954u6k3hbnma3q",
  "refresh_token": "46zc95e3xv954u6k3hbnma3f",
  "token_type": "bearer",
  "expires_in": 2592000
}

On failure (invalid refresh token):

{
  "message": "Invalid Refresh Token"
}

Store both tokens securely and encrypted. Never store them in browser localStorage.

Error Codes

Related Resources

• Getting Started — Register your application and obtain API keys
• Best Practices — Rate limiting, error handling, and security recommendations
• File System API — Manage files and folders after authentication