What authentication method do OSDK applications use?

• A. API keys are used for all requests.
• B. Basic username/password authentication is required.
• C. SAML-based single sign-on is used.
• D. They use the OAuth flow as a public or confidential client to access data.

Answer: (D)

OAuth 2.0 flow is used by OSDK applications to authenticate and access data. In Foundry, OSDK apps act as OAuth clients and can be classified as public or confidential. A public client uses flows designed for apps that can’t securely hold secrets (like a desktop or mobile app), often using Authorization Code with PKCE to obtain an access token. A confidential client, which can securely store credentials, uses flows like Authorization Code or Client Credentials to obtain tokens. The app then presents the access token when calling Foundry APIs, with refresh tokens available to renew access as needed. This approach avoids embedding passwords or API keys in the app and supports secure, delegated access. API keys and basic username/password authentication are not how OSDK apps authenticate, and SAML-based SSO is for user authentication in web sessions rather than API access.