Authentication

Altium Identity is Altium's OAuth 2.0 and OpenID Connect (OIDC) identity provider. Your application authenticates a user through Altium Identity and then calls the Altium 365 API on their behalf — it never handles the user's Altium password.

Applications sign in with the authorization-code flow and PKCE. Public clients (desktop, on-prem, native, single-page apps) use PKCE with no client secret; confidential clients (web/server backends) add a client secret. The step-by-step flows, with every request and response, live on GitHub — this page explains the concepts so you know which path to take.

Token vocabulary

The commercial Altium 365 offering runs across four geographic regions:

For the full anatomy of a token and its claims, see Tokens and OAuth Scopes.

The sign-in journey

The journey is the same for web and desktop/on-prem apps — only how you obtain the authorization code differs (a redirect your app hosts, or the Altium-hosted ActionWait pattern for apps that cannot host one). In every case:

1. Sign in on Commercial Cloud (https://auth.altium.com) to get a global access token. Use it for global resources such as listing the user's workspaces.

2. Discover the user's workspaces with the global token.

3. Exchange the global token for a workspace access token, at the endpoint that matches the workspace (Commercial or Gov Cloud — see below).

4. Call the Altium 365 API with the workspace token, refreshing it at the endpoint that issued it.

sequenceDiagram
    participant App
    participant Identity as Altium Identity
    participant API as Altium 365 API
    App->>Identity: 1. Sign in on auth.altium.com (openid profile) + PKCE
    Identity-->>App: global access token
    App->>API: 2. Discover workspaces (global token)
    API-->>App: workspaces (+ location)
    App->>Identity: 3. Exchange for a workspace token
    Identity-->>App: workspace access token (+ refresh token)
    App->>API: 4. API calls (workspace access token)

An app commonly holds several tokens at once — one global token plus a workspace token per workspace in use. Each refreshes at its own issuing endpoint.

Commercial Cloud and Gov Cloud

Altium 365 runs two strictly separated environments:

• Commercial Cloud (auth.altium.com) — the default environment.
• Gov Cloud (auth.365-gov.altium.com) — an isolated environment for ITAR/regulated workspaces.

A token's issuer (iss) identifies which environment minted it, and the two are never interchangeable: a Gov token is rejected by Commercial services, and a Commercial token is rejected by Gov Cloud. Gov Cloud enforces this with a two-token model — a Gov workspace token carries a secure marker that binds it to Gov Cloud. You sign in once on Commercial Cloud, then exchange your global token for each workspace token on the environment that owns that workspace.

Which flow do I need?

Client libraries

You don't have to implement the flow by hand. Altium maintains open-source libraries built to one language-neutral specification and validated by a shared conformance suite:

Learn more

• Altium 365 Auth — full documentation and libraries (GitHub)

• Altium Identity — integration specification