<img src="../images/07-2_oauth.png" width="300" alt="Example OAuth authorization screen" />

For this tutorial, please use your own sandbox API credentials:

To request API credentials, see [Request API credentials](https://orcid.org/content/register-client-application)

|**scope**| API action(s) you want to request permission for, from the list of [ORCID Scopes](https://members.orcid.org/api/oauth/orcid-scopes). | ```/authorize``` <br> ```/activities/update```

Enter you own client ID where it says [APP-*****************]

Copy your URL, remembering to fill in your own APP details and paste into a new tab and press enter.<br>

2. An ORCID sign-in screen listing the requested permissions will appear; sign into your Sandbox account and click **Authorize**<br>

<img src="../images/04-2_oauth-screen.png" width="400" alt="ORCID OAuth sign-in screen" />

3. After granting permission, you'll be redirected to the Google OAuth Playground. A 6-character code will appear at the end of the redirect URI in the browser address bar (and under the **Step 2** section at left)<br>

Once you have an Authorization Code, you can exchange it for an Access Token and the Authenticated iD of the user who signed in, which you'll need in order to take the API action(s) you requested permission for. You need to store this securely and privately as it contains access tokens, normally you would store this in a database, for now you can store it in a text file on your computer.

2. Change the Oauth endpoints drop down to custom and enter the following settings and click **Close**

| Field | Value |

| ------| ------|

|**OAuth flow**| Server-side |

|**OAuth endpoints**| Custom |

|**Authorization endpoint**| ```https://sandbox.orcid.org/oauth/authorize``` |

|**Token endpoint**| ```https://sandbox.orcid.org/oauth/token``` |

|**Access token location**| Authorization header w/Bearer prefix |

|**OAuth Client ID**| ```[APP-*****************]```<br>(Demo client ID created for this tutorial) |

|**OAuth Client Secret**| ```0000000-0000-0000-0000-000000000000```<br>(Your own client secret created earlier - do not share API client secrets!) |

4. Your Access Token and Authenticated iD will appear **Request/Response** section at right.<br>

_**Important!** Keep the Google OAuth Playground open so that you don't lose the configurations you have made in the steps above. You can also save the URL that allows you to initialize the playground with these configurations (to get the URL, click the link icon next to the gear icon in the upper right corner)._

Once you have gone through this process to obtain the token, this is all that you need to do further api calls for this ORCID and for these permissions. If you want to make calls for another ORCID or you want to write to a record where before you have only read for example, then you will need to complete the process again and get a new token.

**Save this token**

It is important to save the token you received in the step above as you can easily create any calls you need to make with it. If you loose the token you will have to go through the whole process above again.

Once you have gone through this process once and you have the token this is all that you need to do further api calls for this ORCID and for these permissions. If you want to make calls for another ORCID or you want to write to a record where before you have only read for example, then you will need to complete the process again and get a new token.