Page History

To get an access token with patron authentication, you provide your client key and client secret (as with client authentication), but you also provide the patron's username and password.

Overdrive checks the patron's username and password with your ILS. If the ILS says the username and password are valid, you get an access token.

This access token can act on behalf of the patron whose username it was associated with. You can borrow books, place holds, etc.

As with other access tokens, this token is only good for an hour.

Granted authentication is a more complex way of getting an access token to act on behalf of a patron.

When you set up granted authentication with Overdrive, you'll be asked to set up a "redirect URI". (You can change your redirect URI here.) Your redirect URI should point to the oauth_calback controller of your circulation manager, e.g.:

https://my-circulation-manager.com/oauth_callback?provider=Overdrive

When a patron tries to check out a book through Overdrive, Library Simplified circulation manager will tell them to visit a URL based on this template:

https://oauth.overdrive.com/auth?client_id={ID}&redirect_uri={URLredirectedTo}&scope=accountId:{ID}&response_type=code&state={optionalStateParameter}

Overdrive will redirect the patron to... some URL somewhere. I'm not sure yet if it's a URL on your ILS or one managed by Overdrive. Either way, the patron will be asked to log in. Once they log in they will be asked to authorize Library Simplified to act on their behalf. Once they allow this, Overdrive will send them to your redirect URI:

https://my-circulation-manager.com/oauth_callback?provider=Overdrive&state={optionalStateParameter}&code={authorizationCode}

The circulation manager can then use the {authorizationCode} to get an access token to act on behalf of the patron.