您可能需要驗證應用程式使用者是否已授權應用程式。您可以使用 Apigee Audit API 進行驗證。
Outbound OAuth 範例
請參閱 GitHub 上 Apigee api-platform-samples 存放區中的 outbound-oauth 範例。您可以複製、部署及執行範例。這個範例會使用 Microsoft Azure 翻譯工具 API 翻譯推文。為此，系統會發出外送呼叫來取得 OAuth 存取權杖，然後使用 API 服務快取政策快取權杖，每次發出外送呼叫時都會重複使用快取的權杖。此外，還包含用於叫用 API 代理的示範瀏覽器應用程式。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eThis documentation applies to both Apigee and Apigee hybrid platforms, covering various OAuth-related features.\u003c/p\u003e\n"],["\u003cp\u003eWhen using the authorization code grant type, multiple redirect URIs can be specified as a comma-separated list in the developer app's Callback URL field for authenticating across multiple domains.\u003c/p\u003e\n"],["\u003cp\u003eThe GenerateAuthCode operation's default 302 redirect behavior can be customized to return a 200 response with structured JSON containing the code, using ExtractVariables and AssignMessage policies.\u003c/p\u003e\n"],["\u003cp\u003eThe Apigee Audit API enables the verification of end-user consent for app authorization.\u003c/p\u003e\n"],["\u003cp\u003eThe outbound-oauth sample, available in the Apigee api-platform-samples repository on GitHub, demonstrates obtaining and caching OAuth access tokens for outbound API calls.\u003c/p\u003e\n"]]],[],null,["# Advanced OAuth 2.0 topics\n\n*This page\napplies to **Apigee** and **Apigee hybrid**.*\n\n\n*View [Apigee Edge](https://docs.apigee.com/api-platform/get-started/what-apigee-edge) documentation.*\n\nUsing third-party OAuth tokens\n------------------------------\n\nSee [Using third-party\nOAuth tokens](/apigee/docs/api-platform/security/oauth/use-third-party-oauth-system).\n\nDesignating multiple redirect URIs\n----------------------------------\n\nWhen using the authorization code grant type, you must specify a redirect URI when you\nregister your developer app. The redirect URI specifies the URI of an app that is\ndesignated to receive an authorization code on behalf of the client app. The client is required to send this URI to Apigee when\nrequesting authorization codes and tokens, and the `redirect_uri` parameter must match the\none that is registered. See also [Get OAuth 2.0 tokens](/apigee/docs/api-platform/security/oauth/access-tokens).\n\nFor example: \n\n```\nhttps://mydomain.com/authorize?\\\nclient_id=123456&\\\nresponse_type=code&\\\nredirect_uri=https%3A%2F%2Fmydomain.com%2Fcallback&scope=scope1%20scope2&state=abc\n```\n\nThere is a use case for specifying multiple redirect URIs in a single proxy application. For\nexample, you may want to authenticate for multiple domains. For instance:\n\n- `https://mydomain.com/callback`\n- `https://mydomain.uk/callback`\n- `https://mydomain.ja/callback`\n\nTo specify multiple redirect URIs in the developer app, add them as a comma-separated list\nin the **Callback URL** field in the developer app UI. For example: \n\n```\nhttps://mydomain.com/callback,https://mydomain.uk/callback,https://mydomain.ja/callback\n```\n\n\nNote that the `/authorize` request must only carry **one** URI in the `redirect_uri` parameter.\nAs long as the redirect URI matches one of the URIs specified in the **Callback URL** field in developer app UI,\nthe request will succeed.\n\nChanging the default return\nbehavior of a GenerateAuthCode operation\n--------------------------------------------------------------------\n\nBy default, the GenerateAuthCode operation of the [OAuthv2 policy](/apigee/docs/api-platform/reference/policies/oauthv2-policy) returns a `302`\nredirect to the\nredirect URI with a `?code` query parameter containing the authorization code.\n\nIn some cases, you may want to change this behavior. For example, you may want to return a\n`200`\nresponse with structured JSON containing the code.\n\nOne way to accomplish this use case is to set the OAuthV2 policy's\n[GenerateResponse property](/apigee/docs/api-platform/reference/policies/oauthv2-policy#generateresponseelement) to `false`.\nUse the [ExtractVariable policy](/apigee/docs/api-platform/reference/policies/extract-variables-policy) to get the value of the authorization code from the variable\n`oauthv2authcode.{policy_name}.code`. Then, you can use the\n[AssignMessage policy](/apigee/docs/api-platform/reference/policies/assign-message-policy)\nto return the code in a JSON payload with a status of 200.\n\nAuditing app end user consent\n-----------------------------\n\nYou may be required to verify that an app end user authorized an app. You can use the Apigee\nAudit API to do so.\n\nOutbound OAuth sample\n---------------------\n\nSee the [outbound-oauth](https://github.com/apigee/api-platform-samples/tree/master/sample-proxies/outbound-oauth) sample\nin the Apigee api-platform-samples repository on GitHub. You can clone the sample, deploy it, and\nrun it. This sample uses the Microsoft Azure translator API to translate tweets. To do so, it\nmakes an outbound call to obtain an OAuth access token, and then caches the token using the API\nServices caching policies, reusing the cached token each time an outbound call is made. Also,\nincludes a demonstration browser app used to invoke the API proxy."]]
