Authorization Center Mechanism

AuC: Authorization Center Mechanism.

DiDi BNPL is using the JWT_Token authorization mechanism to identify the partner identity.

AuC Work Flow

BNPL api docs图 version 1-part2 - AuC Work Flow.jpg

1. Get Secret Phase

The partner should apply to DiDi for the Client_id and Client_secret.

You can get the client_id and client_secret by contacting the DiDi staff through your business (BD) contact.

P.S. If the client_id and client_secret exposed, pls contact the DiDi BD team directly and ask DiDi team:

discard the old client_id and client_secret.
generate a new client_id and client_secret.

This will be an urgent task for DiDi team. DiDi team will priority it and change it immediately.

2. ACCESS-TOKEN Phase

2.1 The Token Expiration Flow

You should use the POST /external/oauth2/token to get the ACCESS-TOKEN.

This ACCESS-TOKEN will expire in 10 mins. The ACCESS-TOKEN will be always available during this 10 mins whether you generate a new ACCESS-TOKEN or not (valid for 10 mins).

We suggest the integrating party can setup a mechanism to get the next ACCESS-TOKEN within 10 mins, for example 9 mins and 30 seconds.

BNPL api docs图 version 1-part2 - The Token Expiration Flow.jpg

We also contain this logic in this SDK. You can use our SDK to implement this expiration-time control function.

2.2 Token API Request

Path: /external/oauth2/token

Method: POST

Header

Field Name	Field Description	Parameter Value	Present (M/O/C)	Remarks
Content-Type	Content Type	application/x-www-form-urlencoded	M
X-Paylater-Request-Id	Idempotent key(uuid)	e.g., "f81d4fae-7dec-11d0-a765-00a0c91e6bf6"	M	Must be a lowercase UUID string with hyphens. Uppercase or missing hyphens will cause rejection.

Body

Field Name	Type	Field Description	Present(M/O/C)
grant_type	String	Authorization Type. Fixed Value: client_credentials	M
client_id	String	client_id that you get from the "Client Integration Phase".	M
client_secret	String	client_secret that you get from the "Client Integration Phase".	M

2.3 Token API Response

Header

Field Name	Field Description	Parameter Value	Present (M/O/C)	Remarks
Content-Type	Content Type	application/x-www-form-urlencoded	M

Body

Field Name	Type	Field Description	Present(M/O/C)
access_token	String	The access_token information. You should put this value into the Authorization field in the header of the request.	M
token_type	String	The type of token. Normally, it will be Bearer ACCESS-TOKEN.	M
expires_in	Integer	The expiration time. We set it up as 600 seconds. It means that the access_token will expire in 600 seconds.	M
scope	String	The access_token applied scope. Now, it's the fixed value: all.	M

3. API Call Phase

For each API, pls help to insert the access_token into the Authorization field in the header of the request.

For the detail information, pls check the other API specs.

Documentation