Clarabridge Developers | Qualtrics Social Connect

Token	Lifetime
access_token	7890000 seconds
refresh_token	63072000 seconds

                    <?php

// configuration (see {{getCurrentDevelopersDomain()}}/applications)
// set up your application so the redirect_uri runs this script
$clientId = 'YOUR_CLIENT_ID';
$clientSecret = 'YOUR_CLIENT_SECRET';
$scope = 'accounts_read accounts_write';

session_start();
$code = $_REQUEST['code'] ?? null;

if (!empty($_GET['error']) && $_GET['error'] === 'access_denied') {
    echo 'The user did not authorize your application to use your Qualtrics Social Connect account.';
    exit();
}

// Step 1 is generating a session state against CSRF and redirecting the user
// to the authentication url so that they can consent to us using their token.
if (empty($code)) {
    // Put a random state in the session so that we can protect ourselves against CSRF attacks
    $_SESSION['state'] = bin2hex(random_bytes(32));

    $params = [
        'client_id' => $clientId,
        'state' => $_SESSION['state'],
        'response_type' => 'code',
    ];

    if (!empty($scope)) {
        $params['scope'] = $scope;
    }

    $authorizeUrl = 'https://app.engagor.com/oauth/authorize/';
    $authorizeUrl .= '?' . http_build_query($params);

    header("Location: {$authorizeUrl}");
    exit;
}

// Step 2 is converting the code that we got through step 1 to an access token
// We'll need the state that we set in the session as well, to see if we were
// subject to a CSRF attack.
if (empty($code) || $_REQUEST['state'] !== $_SESSION['state']) {
    echo 'The state does not match. You may be a victim of CSRF.';
    exit();
}

$params = [
    'client_id' => $clientId,
    'client_secret' => $clientSecret,
    'grant_type' => 'authorization_code',
    'code' => $code,
];

$tokenUrl = 'https://app.engagor.com/oauth/access_token/';
$tokenUrl .= '?' . http_build_query($params);

// Ideally replace with PSR-18 Http client
$apiResponse = file_get_contents($tokenUrl);
// Do error checking with json_last_error()
$apiResponse = json_decode($apiResponse, true);

if (!$apiResponse['access_token']) {
    echo 'We could not validate your access token.';
    exit();
}

$token = $apiResponse['access_token'];

// You will want to save the access_token and refresh_token (+ details)
// in the database (instead of the session) for re-use later


// When everything was successful, we can start issueing authorized requests
$params = [
    'access_token' => $token,
];

$protectedResource = 'https://api.engagor.com/me/';
$protectedResource .= '?' . http_build_query($params);

$apiResponse = file_get_contents($protectedResource);
// Don't forget error checking with json_last_error()
$content = json_decode($apiResponse, true);

if (!is_array($content) || !isset($content['response'])) {
    throw new RuntimeException('Something went wrong');
}

$user = $content['response'];

echo 'Hello ' . $user['name'];

Key	Description
identify	Identification … know who you are and can access your Qualtrics Social Connect id and name.
accounts_read	Read Access … read data from your Qualtrics Social Connect accounts, projects and topics.
accounts_write	Write Access … update and delete data from your Qualtrics Social Connect accounts, projects and topics.
socialprofiles	Social Profiles … publish to your personal social profiles (Facebook, Twitter, a.o.).
email	Email … know what your email address is.
accounts_handover	Handover … initiate a handover for contacts in your Qualtrics Social Connect accounts, projects and topics.

Qualtrics Social Connect API

Authentication Secure OAuth 2.0. authentication

OAuth endpoints

Server-side user authentication

Server-side user authentication example

Available scopes

Notes