---
category: [Administration & Integrations, Platform and Product Extensions, Platform and Product Extensions/Integration, Administration & Integrations/Custom Integrations & Apps, Platform and Product Extensions/Workday Extend]
keyword: Extend
nav: wcp_docs
parent_url: /wcp_docs/
title: >- 
  Concept: Authorization Flows
layout: subsection
---

After you register your client on the Workday Developer Site, you need this information to request a token to access Workday REST and Graph APIs:

-   Workday Extend REST or Graph API Endpoint: The endpoint to use to access resources in your tenant.
-   Token Endpoint: https://auth.api.workday.com/v1/token.
-   Authorization Endpoint: https://auth.api.workday.com/v1/authorize.
-   Client ID: A unique identifier for your client.
-   Client Secret: The secret used to obtain an access token.


<b>Note:</b> Your account region determines the base URL of the token and authorization endpoints. See [Reference: Workday Extend API Gateways and Authorization Base URLs](/wcp_docs/dlh1653340161856.html).

Workday Extend supports these authorization flows:

<table><thead><tr><th>Authorization Flow</th><th>Use When</th><th>Related Documentation</th></tr></thead><tbody><tr><td>Implicit Grant</td><td>Your client is an app running in a web browser using a scripting language such as JavaScript. Rather than getting an authorization code that needs to be exchanged for an access token, the app directly retrieves an access token.</td><td><a href="/wcp_docs/xjp1528996953713.html">Authenticate Using the Implicit Grant Type</a></td></tr><tr><td>Authorization Code Grant</td><td>Your client is a contextually-aware web app executing on a server. The app can retrieve an access token and, optionally, a refresh token. The access token is passed directly to the web server hosting the app, without going through the user's web browser and risking exposure.</td><td><a href="/wcp_docs/yai1528997518068.html">Authenticate Using the Authorization Code Grant Type</a></td></tr><tr><td>Authorization Code Grant with Proof Key for Code Exchange (PKCE)</td><td>Using PKCE enables public clients to mitigate the threat of having the authorization code intercepted. Your public client first creates a secret, and then uses that secret again when exchanging the authorization code for an access token. If the code is intercepted, it will not be useful since the token request relies on the initial secret.</td><td><a href="/wcp_docs/hfk1553031369488.html">Authenticate Using PKCE with the Authorization Code Grant Type</a></td></tr><tr><td>Client Credentials Grant</td><td>Your client is an app that can grant access to resources without requiring authorization by an end user. In this case, the party that requires access to resources is a computer. Example: The app is an integration that uses an API to import information to a database. The integration holds the Client ID and Client Secret and uses them to get an access token from the authorization endpoint.</td><td><a href="/wcp_docs/vle1524593542839.html">Authenticate Using the Client Credentials Grant Type</a></td></tr></tbody></table><br/>

You can use this diagram to help you decide which authorization flow to use for your client.

![](GUID-cf247a25-a3dd-42c7-aa67-4143e391a694-enHYPHENus.png)

The Workday Extend REST APIs only support the use of bearer tokens for access tokens. All Workday Extend access tokens expire after 60 minutes.

During the initial authorization request, these pages display:

-   A page prompting the current user for their tenant alias.
-   A sign-in page for the tenant (if the current user isn’t already signed in).


<b>Note:</b>

-   If you want Workday users to be able to access a Workday Extend external app from within Workday without being required to reauthenticate, add the `tenantAlias` parameter to the authorization endpoint. Example: `tenantAlias=myTenant`.
-   If you need to test an external app on Workday Extend and don't have an account in a customer's identity provider, you can append the `redirect=n` parameter to the authorization endpoint. This enables you to authenticate natively to the Workday tenant without being redirected to the customer's identity provider for authentication, and returns a token to the external app.