Skip to main content

WebEAM M2M — Setup & Usage

Machine‑to‑Machine (M2M) authentication lets an application authenticate against CAIP APIs without a human being involved. It is the recommended method for productive, API‑to‑API scenarios such as backend services, CLIs, daemons, and automated pipelines.

M2M uses the OAuth 2.0 Client Credentials flow: your application proves its identity with a Client ID and Client Secret, receives a short‑lived access token from WebEAM, and then uses that token as a bearer credential on CAIP API calls.

How the flow works​

  1. Client authentication — your service authenticates directly with WebEAM using its Client ID and Secret.
  2. Token grant — WebEAM verifies the credentials and issues a short‑lived access token.
  3. Call the API — your service sends the token in the Authorization header of each CAIP API request.
  4. Repeat — when the token expires, request a new one.

Because the application itself is authenticated (not a user), this flow is ideal for secure, unattended server‑to‑server communication.

Step 1 — Register your M2M client​

You register an M2M client in the BMW WebEAM Self‑Service Portal. This creates a Client ID and a Client Secret for your application.

  1. Log in to the BMW WebEAM Self‑Service Portal.
  2. In the left sidebar, open Menu → New Configuration.
  3. Choose M2M.
  4. Enter your application name and click Search; results are shown per environment. (Only Integration and Production environments are supported.)
  5. Select your environment and click Next.
  6. Ensure "ClientID and Secret" is checked, then click Next.
  7. Skip the token introspection screen (click Next).
  8. For Endpoint authentication, select Basic Auth.
  9. Choose a token lifespan (or leave the default).
  10. Click Next, give the configuration a meaningful name, and click Save.

The configuration is created with status "In Progress". Provisioning typically takes 1–2 working days (per WebEAM SLAs). You will receive an email containing the Secret linked to your generated Client ID.

Store your Client Secret safely

The Client Secret is shown/sent to you once. Store it in a secret manager, never commit it to source control, and rotate it periodically.

Step 2 — Request permissions for your client​

Registering the client proves identity; it does not yet grant access to your CAIP resources. A registered client must still be authorized for the Spaces / APIs it needs.

TODO — permission request process

The process for requesting and mapping permissions for an M2M client in CAIP is still being finalized.

WebEAM does not currently support custom scopes, so client permissions have to be mapped within the platform's own systems (for example, by associating your Client ID with an App‑ID or CAIP Space). The concrete request path (self‑service portal vs. service request vs. ticket) will be documented here once confirmed.

If you need M2M access before this is finalized, please reach out via Support.

Step 3 — Obtain an access token​

Request a token from the WebEAM M2M OAuth token endpoint using your Client ID and Secret.

Token endpoints:

EnvironmentToken endpoint
DEV / INThttps://auth-i.bmwgroup.net/auth/oauth2/realms/root/realms/machine2machine/access_token
PRODhttps://auth.bmwgroup.net/auth/oauth2/realms/root/realms/machine2machine/access_token

Request a token with cURL:

curl -X POST https://auth-i.bmwgroup.net/auth/oauth2/realms/root/realms/machine2machine/access_token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data 'grant_type=client_credentials&client_id=<your_client_id>&client_secret=<your_client_secret>&scope=machine2machine'

Example response:

{
  "access_token": "ojoxxeJP234WXVzkd7rDs9tDs6es",
  "scope": "machine2machine",
  "token_type": "Bearer",
  "expires_in": 7199
}

The token is a Bearer token and is short‑lived (expires_in is in seconds — roughly two hours in the example above). Cache it and request a new one shortly before it expires rather than fetching one per request.

Step 4 — Call CAIP APIs with the token​

Send the access_token in the Authorization header of your CAIP API requests:

Authorization: Bearer <access_token>
curl https://<caip-api-endpoint> \
  -H 'Authorization: Bearer <access_token>'

That's it — your service is now authenticated for API‑to‑API calls.