Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 14 Next »

This is the new way of authentication when using Bokbasen's APIs

These services are using this new authentication:

  • Onix Export API

  • Object Export API

  • Onix Import API

  • DDS API

  • Bokskya API

  • Order API

All services requires the client to include a token, acquired from the authentication service. The token will be valid for a limited period of time, but valid for all requests during that time interval. So this is done in two steps:

  1. Authenticate to get a token

  2. Call resource with the token as a header (cache/re-use token as long at is is still valid)

The process uses the Client Credentials Flow (defined in OAuth 2.0), where clientId + clientSecret is used to get an access-token.

Login

URL

https://auth.bokbasen.io/oauth/token

Method

POST

Header

content-type

application/json
- or -
application/x-www-form-urlencoded

Request payload

client_id

<Your provided clientId>

client_secret

<Your provided clientSecret>

audience

<Your desired audience / dependent on API>

grant_type

client_credentials

Response (JSON)

access_token

Use this token in the header of API-calls

expires_in

Seconds until token will expire

token_type

Bearer

Returns

200

OK

401

Unauthorized (might be missing som attributes, or wrong clientId/Secret)

403

Forbidden (might not have access to the given audience)

Sample usage - Login

To get a token you have to indicate what audience (what service) you want a token for. See Use of Audience. Here is an example:

Example with json

curl -X POST https://auth.bokbasen.io/oauth/token \
     -H 'content-type: application/json' \
     -d '{
       "client_id":"YOUR-CLIENT-ID",
       "client_secret":"YOUR-CLIENT-SECRET",
       "audience":"https://api.bokbasen.io/metadata/",
       "grant_type":"client_credentials"
     }'

Example with x-www-form-urlencoded

curl -X POST https://auth.bokbasen.io/oauth/token \
     -H 'content-type: application/x-www-form-urlencoded' \
     --data-urlencode client_id=YOUR-CLIENT-ID \
     --data-urlencode client_secret=YOUR-CLIENT-SECRET \
     --data-urlencode audience=https://api.bokbasen.io/metadata/ \
     --data-urlencode grant_type=client_credentials

A successful result will be something like this:

{
  "access_token":"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6Ikd6Vk4wZ044S0pybDBKSWJqSHZhcSJ9.eyJodHRwczovL2Jva2Jhc2VuLmlvL21ldGFkYXRhIjp7fSwiaXNzIjoiaHR0cHM6Ly9sb2dpbi5kZXYuYm9rYmFzZW4uaW8vIiwic3ViIjoiYldReU1IbEJqTGI5TVFCaGVsUFo2emhtYWozdGV0UmJAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vYXBpLmRldi5ib2tiYXNlbi5pby9hcnRpY2xlLyIsImlhdCI6MTY4NDk5NDQ4OSwiZXhwIjoxNjg1MDgwODg5LCJhenAiOiJiV1F5TUhsQmpMYjlNUUJoZWxQWjZ6aG1hajN0ZXRSYiIsImd0eSI6ImNsaWVudC1jcmVkZW50aWFscyIsInBlcm1pc3Npb25zIjpbXX0.TtqnUwmaaUIQ_qV4VPNobVc9vhbzmeKe_w3zOZtkTp1fgF3SXGsL9NMpTgF1CDpMsLVSA7liKSogwR3bsE_-AV7Dki4PK8upx_YKWvcHno6OzdBKErKGf2ftgeRrChUFcaMjkgOXf5BFAaHu5EyR3yZr1zYO0AV4eu4tTRznGBo9Bi-fTAlC95R0VqAOvZINMZbHbG7jQBvfyL9EvleoB1vN7bMjcNHXQ_SkEMU0q58N7CmGPbPuevE40KwXsxghgXiSzOeHO3rDdYzK04tXbmKwIYVgWHIb21KILZbQGoyxj7wkbXoFehcqtQWxn5j25BN5aKwXXzS6hNE54b062g",
  "expires_in":86400,
  "token_type":"Bearer"
}

Sample usage - Calling other API

When access_token has been fetched, we can call other APIs (corresponding to the audience used):

curl -X POST https://api.bokbasen.io/foo/bar/book/123 \
     -H 'content-type: application/json' \
     -H 'Authorization: Bearer <access_token_here>'

Change to how Authorization-header is constructed

  • (error) No longer use Authorization: Boknett TGT-...

  • (tick) Instead use: Authorization: Bearer <access_token_here>

Token expiration

We are optimizing when new tokens are generated and therefore you will see that expires_in will change dynamically through out the day. We are then serving you cached access_token while it is valid (we will not give you a token with less than 10 minutes left).

Caching token

If you want to reduce number of needed calls, we encourage you to cache it, just look at the expires_in (seconds) or look at exp in the payload-part of the JWT-token (right before you do the API-call).

Note that expires_in is dynamic and will just show number of seconds until the token is no longer valid.

Environments

Each environment has it’s own set of credentials

PROD

https://auth.bokbasen.io/oauth/token

TEST

https://auth.stage.bokbasen.io/oauth/token

  • No labels