Search In: Doc:Documentation: Altium Developer Center
Altium DesignerAltium 365Altium MCAD CoDesignerAltium On-Prem Enterprise ServerAltium CircuitMakerAltium CircuitStudioCompany DashboardAltium Infrastructure ServerAltium Developer Center
Close
Search Search on Documentation

Authentication

Updated: August 03, 2026

Altium Identity is Altium's OAuth 2.0 and OpenID Connect (OIDC) identity provider. Your application authenticates a user through Altium Identity and then calls the Altium 365 API on their behalf — it never handles the user's Altium password.

Applications sign in with the authorization-code flow and PKCE. Public clients (desktop, on-prem, native, single-page apps) use PKCE with no client secret; confidential clients (web/server backends) add a client secret. The step-by-step flows, with every request and response, live on GitHub — this page explains the concepts so you know which path to take.

Full flows, code, and libraries → Altium 365 Auth on GitHub. The GitHub project is the source of truth: language-neutral specification, a shared conformance suite, and idiomatic client libraries for TypeScript and .NET.

Token vocabulary

The commercial Altium 365 offering runs across four geographic regions:

Term

What it is

Global access token

A user-level token you receive after sign-in with the openid profile scopes. Use it to discover which workspaces the user can access.

Workspace access token

A token scoped to a single workspace through the a365:workspace:{workspaceId} scope. Use it for Altium 365 API calls against that workspace.

Refresh token

Issued when you request the offline_access scope. Use it to obtain a new access token — global or workspace — without asking the user to sign in again.

For the full anatomy of a token and its claims, see Tokens and OAuth Scopes.

The sign-in journey

The journey is the same for web and desktop/on-prem apps — only how you obtain the authorization code differs (a redirect your app hosts, or the Altium-hosted ActionWait pattern for apps that cannot host one). In every case:

  1. Sign in on Commercial Cloud (https://auth.altium.com) to get a global access token. Use it for global resources such as listing the user's workspaces.

  2. Discover the user's workspaces with the global token.

  3. Exchange the global token for a workspace access token, at the endpoint that matches the workspace (Commercial or Gov Cloud — see below).

  4. Call the Altium 365 API with the workspace token, refreshing it at the endpoint that issued it. 

sequenceDiagram
    participant App
    participant Identity as Altium Identity
    participant API as Altium 365 API
    App->>Identity: 1. Sign in on auth.altium.com (openid profile) + PKCE
    Identity-->>App: global access token
    App->>API: 2. Discover workspaces (global token)
    API-->>App: workspaces (+ location)
    App->>Identity: 3. Exchange for a workspace token
    Identity-->>App: workspace access token (+ refresh token)
    App->>API: 4. API calls (workspace access token)

An app commonly holds several tokens at once — one global token plus a workspace token per workspace in use. Each refreshes at its own issuing endpoint.

Skip the discovery step. When you already know the user should land on a workspace, the optional selectWorkspace parameter prompts the user to choose one during sign-in, and the code exchange returns a workspace-scoped token directly. See Login into workspace mode.

Commercial Cloud and Gov Cloud

Altium 365 runs two strictly separated environments:

  • Commercial Cloud (auth.altium.com) — the default environment.
  • Gov Cloud (auth.365-gov.altium.com) — an isolated environment for ITAR/regulated workspaces.

A token's issuer (iss) identifies which environment minted it, and the two are never interchangeable: a Gov token is rejected by Commercial services, and a Commercial token is rejected by Gov Cloud. Gov Cloud enforces this with a two-token model — a Gov workspace token carries a secure marker that binds it to Gov Cloud. You sign in once on Commercial Cloud, then exchange your global token for each workspace token on the environment that owns that workspace.

Which flow do I need?

Your application

Flow

Guide
Web or server app that can host an HTTPS redirect endpoint

Authorization-code redirect flow

Web & server apps

Desktop, on-prem, or native app that cannot host a redirect

Browser sign-in over the Altium-hosted ActionWait pattern

Desktop & on-prem apps

Client libraries

You don't have to implement the flow by hand. Altium maintains open-source libraries built to one language-neutral specification and validated by a shared conformance suite:

Language

Reference documentation

TypeScript TypeScript library
.NET .NET library

Learn more

If you find an issue, select the text/image and pressCtrl + Enterto send us your feedback.
Content