Rslcollective Org Authentication

generated: '2026-10-27'
method: searched
source: https://rslstandard.org/rsl
docs: https://rslstandard.org/rsl
related_docs:
- https://rslstandard.org/guide/license-servers
- https://rslcollective.org/developers
summary: >-
  The RSL Collective license server (https://api.rslcollective.org, named as the server in the
  collective's own RSL license examples and listed as an RSL License Server in the RSL Standard guide)
  is governed by the RSL 1.0 Open License Protocol (OLP), which the collective's editors publish at
  rslstandard.org. OLP is an OAuth 2.0 extension: clients authenticate to every OLP endpoint with HTTP
  Basic client credentials and receive an opaque License Token, which they then present to resource
  servers using the CAP `License` HTTP authentication scheme. Credentials are obtained by joining via the
  RSL Collective dashboard ("Join for free to request access to the RSL Collective licensing APIs and
  tools"). Not verified against the live server: no endpoint was called (auth endpoints are out of scope
  for probing).
schemes:
- name: olpClientBasic
  type: http
  scheme: basic
  applies_to: [POST /token, POST /introspect, POST /key]
  description: >-
    "Clients MUST authenticate to all OLP endpoints using the HTTP Basic scheme as defined in [ RFC 7617 ].
    The Authorization header MUST contain a Base64-encoded string of the form client_id:client_secret."
  credentials_issuance: >-
    "Each client application that interacts with a License Server is assigned a unique client_id and
    client_secret by the server operator during registration"
  failure: HTTP 401 with an invalid_client JSON error object
- name: olpClientCredentials
  type: oauth2
  flows:
    clientCredentials:
      tokenUrl: https://api.rslcollective.org/token
      scopes: {}
  description: >-
    "This endpoint uses the OAuth 2.0 Token Endpoint defined in [ RFC 6749 ] with the client_credentials
    grant type." Requests carry grant_type, license (URL-encoded RSL <license> XML), optional license_type
    and resource. The response returns access_token, token_type "License" and expires_in (0 = non-expiring).
  token_url_note: tokenUrl is the documented /token path joined to the server attribute https://api.rslcollective.org.
- name: capLicense
  type: http
  scheme: License
  description: >-
    Crawler Authorization Protocol: "It introduces a new authentication scheme, License , which uses the
    standard Authorization and WWW-Authenticate headers to transmit and validate License Tokens over HTTPS
    connections." Used by crawlers toward publisher resource servers; failures return 401 Unauthorized or
    402 Payment Required with a Link header to the governing RSL license.