Authentication

Overview

dSilo data calls use Microsoft Entra ID (Azure AD) with the OAuth 2.0 client credentials flow. Your application requests an access token, then sends it as a Bearer token on every API request together with the APIM subscription key and backend x-api-key.

What you need from onboarding

Entra tenant ID

Application (client) ID — <CUSTOMER-CLIENT-ID>

Client secret — <CUSTOMER-CLIENT-SECRET>

API application ID URI used in scope — api://<app-id>

App role Data.Read granted to your client

Request an access token

POST https://login.microsoftonline.com/<TENANT-ID>/oauth2/v2.0/token

Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials

client_id=<CUSTOMER-CLIENT-ID>

client_secret=<CUSTOMER-CLIENT-SECRET>

scope=api://<app-id>/.default

From the JSON response, copy only access_token. Do not use id_token. Treat the token as a secret — never paste live tokens into docs, tickets, or chat.

Send the token on API calls

Authorization: Bearer <ACCESS-TOKEN>

Also send Ocp-Apim-Subscription-Key: <SUBSCRIPTION-KEY> and x-api-key: <API-Key>. Missing or invalid tokens return 401 Invalid or missing access token. Missing Data.Read or wrong audience also fails validation at the gateway.

Token lifetime

Access tokens expire (typically about one hour). Request a new token when exp is near or when you receive 401 for an expired token. Do not hard-code tokens in clients — request them at runtime and cache briefly in memory.

Related

Required headers — how Authorization, subscription key, and x-api-key work together.

Getting started — end-to-end checklist from token to first successful summary call.