---
category: [Administration & Integrations, Platform and Product Extensions, Platform and Product Extensions/Integration, Administration & Integrations/Custom Integrations & Apps, Platform and Product Extensions/Workday Extend]
keyword: [Extend, OAuth]
nav: wcp_docs
parent_url: /wcp_docs/
title: Authenticate Using the Implicit Grant Type
layout: subsection
---

### Prerequisites

<a id="prereq_N10021_N1001E_N10001"></a>
[Register your API Client](/wcp_docs/zwx1518028675482.html) on the Workday Developer Site.

### Context

<a id="context_N10027_N1001E_N10001"></a>
For this authorization flow, you send an initial authorization request, the user signs in and the authorization endpoint returns the access token.

<b>Important:</b> According to the OAuth 2.0 Security Best Current Practice working document, the implicit grant type is vulnerable to access token leakage and access token replay. Workday recommends that you configure your API Client to authenticate using PKCE with the authorization code grant type.

### Steps

1.  <a id="step_N10031_N1002E_N1001E_N10001"></a>Send the initial authorization request to the authorization endpoint.

    Use these query parameters:

    -   response_type: Token (for implicit grant).
    -   client_id: Use the value received at registration.
    -   redirect_uri (Optional): If included in the request, must match a value specified for your app.

        If no redirect_uri is specified, the first value specified for your client is used for redirection.


2.  <a id="step_N10051_N1002E_N1001E_N10001"></a>Send this authorization request to the authorization endpoint (not the Workday REST API endpoint):

    ```
    GET https://auth.api.workday.com/v1/authorize?response_type=token&client_id=MTIzNDg0NGYtM2VjMy00MDA4LTk1YTgtMTRhZGMzMzg1ODZl&state=xyz&redirect_uri=http://localhost:8080/your/redirect.html
    ```

    This response is sent, containing the access token (for this example, the redirect URI was set to https://example.com during client registration):

    ```
    HTTP/1.1 302 Found Location: https://example.com/#access_token=111fq660e8q46sh5x5q17hdht60mgpg8uwmlk0hqf&state=xyz&token_type=Bearer
    ```

3.  <a id="step_N1006B_N1002E_N1001E_N10001"></a>To subsequently access Workday resources, set the Authorization header in the requests you send to the Workday REST API endpoint. Set the Authorization header to the token_type value and access_token value:

    ```
    GET https://api.workday.com/common/v1/workers Authorization: Bearer 111fq660e8q46sh5x5q17hdht60mgpg8uwmlk0hqf
    ```

    The token timeout is tied to the session timeout configured for the user by the Workday administrator. When the token expires, send another authorization request to the authorization endpoint.



### Related Information

[Reference: Workday Extend API Gateways and Authorization Base URLs](/wcp_docs/dlh1653340161856.html)