All Uber APIs utilize OAuth 2.0, an industry standard protocol for Authorization. For more details about this protocol, refer here.

Uber’s Demand Partner APIs use two modes of authorization:

• Authorization Code Grant and Client Credentials Grant. Authorization Code Used for APIs that access or expose information for a specific rider. This grant type involves an authorization code exchanged for an access token, providing secure and controlled access to rider-specific data.
• Client Credentials: Applied to APIs that do not require user-specific data. This grant type allows applications to authenticate directly and obtain an access token, suitable for general application access to the platform.

¶ OAuth using Authorization Code

The following describes the process for performing actions on behalf of a User, especially in cases involving data sharing within the user’s context. Examples include accessing user profile information, trip data, or saved locations. To use this authorization mode, explicit user consent is required to ensure compliance with data privacy regulations.

Demand partners need to obtain an access token for the corresponding rider to call endpoints that provide rider information. The steps for obtaining the access token for a rider are outlined below (assuming that you already have a developer application to play with. Otherwise, go back here):

1. Application configuration

Demand partners need to expose two HTTP endpoints: <REDIRECT_URI> and <PRIVACY_POLICY_URL>.

<REDIRECT_URI>	After a rider completes the OAuth process, an HTTP redirect will be made to this URL with an authorization code. This code can then be exchanged at the token exchange endpoint to obtain an access token corresponding to the rider.
<PRIVACY_POLICY_URL>	This URL links the OAuth screen to the demand partner’s data handling policy, providing transparency about how rider data will be used and protected.

Both the Redirect URI and Privacy Policy URL must be registered in the developer dashboard.

2. Account Linking Flows (Universal Link)

¶ Initiate Account Linking From Partner App to Uber

Step 1 - OAuth /authorize request and response

HTTP Method	GET
Domain	auth.uber.com
Path	/oauth/v2/universal/authorize

Query Parameters

client_id=<your_client_id>
response_type=code
redirect_uri=<your_client_redirect_uri>
scope=<space_delimited_scope(s)>
state=<state_value>

Sample Request

https://auth.uber.com/oauth/v2/universal/authorize?client_id=_cFkbH2YMPySpRoTcnywPq72x_zJPErm&response_type=code&redirect_uri=<partner_redirect_uri>&scope=profile%20profile.mobile_number%203p.rides.demand.fulfillment.user&state=<your_state>

Response

HTTP Status Code 302
Location: http://localhost/?code=<authorization_code>&state=<your_state>

Please refer to the appendix section about what the state parameter is and how to implement it.

Step 2 - OAuth /token request and response

HTTP Method	POST
Domain	auth.uber.com
Path	/oauth/v2/token

Form Body (content-type: application/x-www-form-urlencoded)

client_id=<your_client_id>
client_secret=<client_secret>
redirect_uri=<your_client_redirect_uri>
scope=<space_delimited_scope(s)>
grant_type=authorization_code
code=<authorization_code>

Sample Request

curl -d 'client_secret=<client_secret>' \
     -d 'client_id=<client_id>' \
     -d 'grant_type=authorization_code' \
     -d 'redirect_uri=<partner_redirect_uri>' \
     -d 'code=<AUTHORIZATION_CODE_FROM_STEP_1>' \
     "https://auth.uber.com/oauth/v2/token"

Response

{
    "access_token": "<access_token>",
    "token_type": "Bearer",
    "expires_in": 2592000,
    "refresh_token": "<refresh_token>",
    "scope": "offline_access profile profile.mobile_number"
}

expires_in is expressed in seconds — 2592000 seconds equals 30 days. As shown in the sample above, the Uber-issued access token lasts 30 days.

Step 3 - Get User Profile

HTTP Method	GET
Domain	api.uber.com
Path	/v1.2/me

Required HTTP Header

Header Key	Header Value
Authorization	Bearer <access_token>

Sample Request

curl -kv https://api.uber.com/v1.2/me -H 'Authorization: Bearer <ACCESS_TOKEN_FROM_STEP_2>'

Response

{
    "uuid": "",
    "rider_id": "<unique_uber_user_identifier>",
    "first_name": "<first_name>",
    "last_name": "<last_name>",
    "email": "<email_address>",
    "picture": "<profile_picture_url>",
    "promo_code": "<uber_promo_code>",
    "mobile_verified": <true | false>,
    "mobile_number": "<mobile_number>"
}

uuid will be empty. Fetch the Uber user’s unique identifier from the rider_id attribute instead.

[For Testing Only] Re-test Uber OAuth Consent Page

In Step 1, users are prompted to complete login/signup and consent. Note that the user only needs to consent once for a specific client and the requested scopes. During development, if you want to prompt users to consent again, add the query parameter prompt=consent to the /authorize request.

Additional query parameter required: prompt=consent

Sample Request

https://auth.uber.com/oauth/v2/universal/authorize?client_id=_cFkbH2YMPySpRoTcnywPq72x_zJPErm&response_type=code&redirect_uri=<partner_redirect_uri>&scope=profile%20profile.mobile_number%203p.rides.demand.fulfillment.user&state=<your_state>&prompt=consent

Refresh Token Flow

After riders complete the initial account linking, Uber issues a refresh token in addition to the access token. The refresh token can be used to get a new access token if the previous one expires, preventing riders from needing to interact with Uber apps again for account linking purposes.

HTTP Method	POST
Domain	auth.uber.com
Path	/oauth/v2/token

Body

client_id=<your_client_id>
client_secret=<client_secret>
grant_type=refresh_token
refresh_token=<refresh_token>

Request

curl -d 'client_secret=<client_secret>' \
     -d 'client_id=_cFkbH2YMPySpRoTcnywPq72x_zJPErm' \
     -d 'grant_type=refresh_token' \
     -d 'refresh_token=<REFRESH_TOKEN_FROM_STEP_2>' \
     "https://auth.uber.com/oauth/v2/token"

Response

{
    "access_token": "<access_token>",
    "token_type": "Bearer",
    "expires_in": 2592000,
    "refresh_token": "<refresh_token>",
    "scope": "profile profile.mobile_number offline_access"
}

¶ Universal Link

Overview

Uber supports the universal link feature, enabling both basic account linking and app-to-app account linking flows. When an authorization request is invoked using the universal link, if any Uber app is installed on the rider’s device, the app-to-app account linking experience will take precedence. Otherwise, account linking will occur through the default browser.

The universal authorization URL is:

https://auth.uber.com/oauth/v2/universal/authorize?{params}

User Experience

Case 1: One Uber App Installed (general behavior across iOS and Android) When invoking the universal link, the installed Uber app will open for authentication and authorization.

Case 2: No Uber App Installed (general behavior across iOS and Android) When invoking the universal link, the default browser on the rider’s device will open for authentication and authorization.

Case 3: More than One Uber App Installed

• iOS: The device will open the Uber app in the following fallback order: Rides -> Eats -> Postmates -> Driver.
• Android:
  • Older versions: The device will show a disambiguation dialog asking the rider which Uber app to open.
  • Newer versions: The device will open the latest installed Uber app. For example, if the rider installed the Uber apps in this order — Rides, Eats, Driver — the Driver app will be opened.

¶ Token management

Token Management is crucial for maintaining secure access to our platform. It involves generating, refreshing, and revoking access tokens. Follow this link for detailed guidelines on token generation, refreshing token, and revoking token.

¶ OAuth using Client Credentials

The Client Credentials grant type is another authentication method to authorize APIs. It is specifically designed for actions performed on behalf of an application, rather than an individual user. This grant type is suitable for scenarios where APIs do not require access to user-specific data, such as system-level integrations or machine-to-machine communication. For example, our Rides API, price and estimated endpoint, Eats Menu API, etc.

Getting Access Token

To obtain an Access Token using the Client Credentials grant type, three essential components are required:

• Client ID: A unique identifier assigned to your application when you register it on the platform.
• Client Secret: A confidential key associated with your application, used for authentication during token exchange.
• Scope Names: Specific permissions or scopes that define the actions your application is allowed to perform.

Steps to Obtain Client Credentials

1. Create and Configure Your Application:

   • Log in to the Uber Developer Dashboard.
   • Click on Create Application.
   • Fill in the required details (e.g., privacy policy URLs, redirect URLs) in the setup tab.
   • Once created, your application will appear under the TestApp section as shown in Fig 1.

2. Access Token via Client Credentials:

   • Navigate to the Access Token section under your application settings.
   • Select the Client Credentials option.
   • Note the Scopes Authorized displayed. These are the permissions an application requires.

3. Generate Client ID and Client Secret:

   • Click on Generate to create your Client ID and Client Secret.
   • Save these credentials securely. They are essential for authenticating an application and obtaining an access token.

   Example Request:

   curl --location 'https://auth.uber.com/oauth/v2/token' \
      --form 'client_secret="<CLIENT_SECRET>"' \
      --form 'client_id="<CLIENT_ID>"' \
      --form 'grant_type="client_credentials"' \
      --form 'scope="<SPACE_DELIMITED_LIST_OF_SCOPES>"'
   

   In this request provide Client ID, Client Secret, Grant Type (set to client_credentials for the client credential flow), and the Scopes which the demand partner wants to access.

   Example Response:

   {
      "access_token": "<TOKEN>",
      "expires_in": 2592000,
      "token_type": "Bearer",
      "refresh_token": "<REFRESH_TOKEN>",
      "scope": "SCOPES_PASSED_EARLIER_FOR_OAUTH"
   }
   

   Upon successful authentication and authorization, the platform returns an Access Token, along with additional information such as the expiration time (expires_in), token type (Bearer), a Refresh Token for token renewal, and the associated scope.

4. Access Token Expiration

   • The Access Token obtained through the Client Credentials flow has a limited lifespan, as indicated by the expires_in field in the response. Typically, Access Tokens expire after a certain period of time. It’s crucial to manage token expiration and implement token refreshing mechanisms to maintain secure and uninterrupted access to APIs.