Authentication

Protected WEDA APIs require a bearer token:

Authorization: Bearer {accessToken}

Tokens are issued through an OIDC SSO flow. The token is valid for 2 hours and carries the IAM roles of the signed-in user.

Identity URL

Use identity as the ssoBaseUrl in WEDA v1.1.0 and later. The previous {tenantPath}/identity and central/identity paths are no longer supported.

---

User Token (SSO)

The user token uses an OIDC-based SSO flow. Use the 0-WiseSso Postman collection from the WEDA API Collection — it handles cookie management and HTML parsing between steps automatically.

Configure the Postman Environment

Set these variables in the weda-core environment before running:

Variable	Example value	Description
login	you@company.com	Your WEDA account email
password	••••••••	Your WEDA account password
domain	https://tpe.cloud.advantech.com	Base URL for your WEDA deployment
tenantPath	central	Tenant path segment
appPath	weda	Application path segment
ssoBaseUrl	identity	SSO service path

Protect authentication secrets

Do not share or export a Postman environment that contains your password, clientSecret, access token, or refresh token.

Flow

Step 1 — Initialize SSO session

GET {domain}/{tenantPath}/portal/external-login
    ?returnUrl={domain}/{tenantPath}/{appPath}

Response: 302. Establishes the session context; tenantId is extracted from the redirect Location header.

---

Step 2 — Submit credentials

POST {domain}/{ssoBaseUrl}/api/v1.0/account/login

{
  "account": "{login}",
  "password": "{password}",
  "tenantId": "{tenantId}"
}

Response: 200. Sets the Identity.Permission session cookie.

---

Step 3 — Obtain OIDC authorization code

GET {domain}/{tenantPath}/portal/external-login
    ?returnUrl={domain}/{tenantPath}/{appPath}

Response: 200 with an HTML form containing hidden code, state, and iss fields. The Postman script parses the HTML to extract form_action, code, state, and iss.

---

Step 4 — Complete OIDC sign-in

POST {form_action}
Content-Type: application/x-www-form-urlencoded

code={code}&state={state}&iss={iss}

Response: 302. Sets the AdvOidc.Login cookie.

---

Step 5 — Exchange for WEDA token

POST {domain}/{tenantPath}/{appPath}/api/v1/auth/tokens

No body — the call uses the cookies set in the previous steps.

See Create JWT access token for full field reference.

{
  "accessToken": "eyJ...",
  "refreshToken": "30a8e6b809ff43ac8abe267a5f93ef31",
  "expiresIn": 7200,
  "tokenType": "Bearer"
}

Use accessToken as your Bearer token. Tokens expire after 2 hours; use refreshToken to renew without repeating the full flow.

POST {domain}/{tenantPath}/{appPath}/api/v1/auth/tokens?grant_type=refresh_token
Content-Type: application/json

{
  "refreshToken": "{refreshToken}"
}

Implementing without Postman

If you call these endpoints in code, your HTTP client must:

• Preserve cookies across all 5 requests
• Parse the HTML in step 3 to extract form_action and the hidden form fields

---

Programmatic Access

Obtaining a token without an interactive user login is not documented in this release. Contact Advantech support if your integration requires it.

---

Related

• User & Role Management — manage user accounts and IAM roles
• WEDA Postman API Collection — download the 0-WiseSso collection
• Postman walkthrough: Get Access Token

---

Last updated on Aug-1, 2026 | Version 1.1.1