Skip to main content

Machine-to-Machine API Authentication

Champion Data provides Machine-to-Machine (M2M) authentication for the AFL API where an application, rather than a person, will be regularly communicating with the API. M2M authentication standardises how systems safely verify each other's identity and exchange data.

What is M2M Authentication?​

Machine-to-Machine (M2M) authentication relies on the OAuth 2.0 Client Credentials Grant flow. It allows a non-human client (such as a backend server, daemon, cron job, or microservice) to authenticate itself directly against an Authorization Server (such as Auth0) to gain access to a protected resource (an API).

Instead of credentials belonging to a person, credentials belong directly to the requesting application.

note

AFL Odyssey uses a M2M to communicate with the AFL API, providing continuous access without requiring human input.

How M2M differs from User Account Authentication​

Historically, server-to-server communication often relied on Basic Authentication (passing a username and password in every HTTP request header) or simple static API keys. Modern systems prefer M2M access tokens for several security reasons:

  • Maintains authorised and connected to the AFL API for 24 hours (the lifetime of a M2M access token)
  • Doesn't represent a specific person at an organisation despite the connection being used by multiple people. This proves problematic when that person leaves the organisation
  • User accounts can be subject to Multi-Factor Authentication which impairs connectivity when humans aren't available to approve the authentication

Step-by-Step: Authenticating and Calling the AFL API with an M2M​

Step 1: Request an Access Token​

To obtain an access token your application sends its M2M Client Id and Client Secret to Auth0's /oauth/token endpoint.

curl --request POST \
  --url 'https://championdata-afl.au.auth0.com/oauth/token' \
  --header 'content-type: application/json' \
  --data '{
    "client_id": "YOUR_M2M_CLIENT_ID",
    "client_secret": "YOUR_M2M_CLIENT_SECRET",
    "audience": "https://api.afl.championdata.io",
    "grant_type": "client_credentials"
  }'

Step 2: Store the Access Token​

Upon validation, Auth0 responds with a JSON Web Token (JWT):

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 86400
}

The "access_token" should be kept for repeated use to authenticate with the AFL API. The "expires_in" value, 86400, is the number of seconds this access token will be valid for. This is 24 hours.

note

Each M2M is limited to requesting 10 access tokens at a time. An eleventh token will not be supplied until the first token obtained has expired.

Step 3: Call the AFL API​

With the access token in hand, your application makes requests to the API endpoints (such as fetching league data via /v1/leagues) by passing the token in the Authorization header:

curl --request GET \
  --url 'https://api.afl.championdata.io/v1/leagues' \
  --header 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...' \
  --header 'Accept: application/json'

When the request reaches the AFL API, the API validates the incoming access token and expiration time, ensuring your server gets access to the requested AFL data without ever exposing primary credentials to the API layer.

Last updated on