如何在Autodesk Forge中获取2-legged认证及解决API调用失败问题

Common Troubleshooting Steps #

• Scope Mismatch: The access token must include the exact scopes required by the API endpoint you're calling. For example:
  • Use data:read/data:write for Model Derivative API operations
  • Use bucket:read/bucket:write for Object Storage Service (OSS) operations
    Check the decoded token payload (see below) to confirm the scopes match your target API's requirements.
• Incorrect Authorization Header: Ensure your API request includes the header in this exact format:

  Authorization: Bearer <your-access-token>
  

  Double-check for typos, missing spaces between "Bearer" and the token, or extra characters.
• Expired Token: 2-legged tokens expire after 3600 seconds (1 hour) by default. Verify the exp timestamp in the token payload to confirm it hasn't expired.
• Invalid Client Credentials: Confirm the client ID and secret used to generate the token are associated with a valid Forge app, and the app has been granted the required scopes in the Forge Developer Portal.
• Wrong API Endpoint: Ensure you're using the correct production endpoint (all Forge APIs start with https://developer.api.autodesk.com/). Avoid staging or deprecated endpoints unless explicitly required.

How to Validate Your Access Token #

1. Decode the JWT Payload:
   The token is a JWT split into three dot-separated parts. Decode the middle base64-encoded section to inspect:
   • scopes: List of permissions granted to the token
   • exp: Unix timestamp of when the token expires (convert to local time to check validity)
   • client_id: Should match your Forge app's client ID
2. Test with a Minimal API Call:
   Use a simple request that aligns with your token's scopes. For example, if your token has bucket:read, run this command:

   curl -H "Authorization: Bearer <your-token>" https://developer.api.autodesk.com/oss/v2/buckets
   

   A successful response (even an empty bucket list) confirms the token is valid. An error here points to issues with the token or app permissions.

Example Successful API Call #

If you're using the Model Derivative API to translate a design, ensure your token has data:read and data:write scopes. Here's a sample curl command:

curl -X POST \
  https://developer.api.autodesk.com/modelderivative/v2/designdata/job \
  -H "Authorization: Bearer <your-access-token>" \
  -H "Content-Type: application/json" \
  -d '{
    "input": {
      "urn": "<base64-encoded-urn-of-your-design>"
    },
    "output": {
      "formats": [
        {
          "type": "svf",
          "views": ["2d", "3d"]
        }
      ]
    }
  }'

Additional Notes #

• 2-legged tokens are for application-level access only—they can't be used for user-specific APIs (like BIM 360 Document Management) which require 3-legged authentication.
• If you're still getting errors, check the API response details (e.g., error code, message) for more specific clues. Common codes include 401 Unauthorized (invalid token/scopes) or 403 Forbidden (insufficient permissions).

内容的提问来源于stack exchange，提问作者Koushik 1219