Salt la continutul principal

Autentificarea API-ului platformei (JWT)

API-ul REST al vitalera utilizeaza autentificare JWT (JSON Web Token) bazata pe standardul OAuth 2.0.

Obtinerea credentialelor​

Contactati support@vitalera.io pentru a solicita:

  • Client ID -- identifica aplicatia dumneavoastra
  • Client Secret -- autentifica aplicatia dumneavoastra
  • Application ID -- utilizat pentru rotatia credentialelor

Client Credentials Grant​

Pentru integrari server la server (machine-to-machine):

curl -X POST "https://api.vitalera.io/api/auth/tokens/" \
     -H "Content-Type: application/json" \
     -d '{
           "grant_type": "client_credentials",
           "client_id": "<CLIENT_ID>",
           "client_secret": "<CLIENT_SECRET>"
         }'

Raspuns:

{
  "access_token": "<ACCESS_TOKEN>",
  "token_type": "Bearer",
  "expires_in": 3600
}

Password Grant​

Pentru fluxuri de autentificare a utilizatorilor (de exemplu, aplicatii mobile sau web care autentifica utilizatori individuali):

curl -X POST "https://api.vitalera.io/api/auth/tokens/" \
     -H "Content-Type: application/json" \
     -d '{
           "grant_type": "password",
           "username": "<USERNAME>",
           "password": "<PASSWORD>"
         }'

Raspuns:

{
  "id_token": "<ID_TOKEN>",
  "access_token": "<ACCESS_TOKEN>",
  "refresh_token": "<REFRESH_TOKEN>",
  "sub": "<USER_ID>"
}

Efectuarea cererilor API​

Includeti token-ul de acces in header-ul Authorization al fiecarei cereri:

curl -X GET "https://api.vitalera.io/api/plans/" \
     -H "Authorization: Bearer <ACCESS_TOKEN>"

Valabilitatea token-ului​

Token-urile de acces sunt valabile timp de 1 ora (3600 secunde). Cand un token expira, API-ul returneaza HTTP 401 Unauthorized:

{
  "errors": [
    {
      "errorType": "expired_token",
      "message": "Access token expired"
    }
  ]
}

Reimprospatarea token-ului​

Daca ati obtinut un refresh token (prin password grant), puteti reimprospta token-ul de acces fara a va reautentifica:

curl -X POST "https://api.vitalera.io/api/auth/tokens/refresh/" \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer <ACCESS_TOKEN>" \
     -d '{
           "refresh_token": "<REFRESH_TOKEN>"
         }'

Validarea token-ului​

Verificati daca un token este inca valid:

curl -X GET "https://api.vitalera.io/api/auth/tokens/validate/" \
     -H "Authorization: Bearer <ACCESS_TOKEN>"

Rotatia credentialelor​

Pentru securitate, rotiti periodic credentialele clientului. Aceasta necesita un JWT valid si application_id:

curl -X POST "https://api.vitalera.io/api/applications/rotate_credentials/" \
     -H "Authorization: Bearer <ACCESS_TOKEN>" \
     -H "Content-Type: application/json" \
     -d '{
           "application_id": "<APPLICATION_ID>"
         }'

Raspuns:

{
  "id": "<APPLICATION_ID>",
  "name": "TestApp",
  "organization": "123",
  "client_id": "<NEW_CLIENT_ID>",
  "client_secret": "<NEW_CLIENT_SECRET>",
  "application_types": ["API"]
}

Dupa rotatie, credentialele anterioare sunt invalidate imediat.

Aveti nevoie de ajutor?​

Contactati support@vitalera.io pentru asistenta la configurarea autentificarii.