• Token Verification
  • Request
  • Response
  • Breakdown
    • Request
    • Headers
    • Response
  • Caching

#Token Verification

Depending on where in your back-end application you need to verify the token (also known as an access token), you may need to do so.

For instance, some server applications check the Authorization header for each request (typically via middleware) and only allow access to the resource if the check passes.

Here is a sample curl for token verification:

#Request

curl --request POST ``https://api.ssofy.com/v1/authenticated/verify` \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--header 'Api-Key: cf47d697-cc0b-4262-8329-78a0995e6fd0' \
--header 'Signature: eyJoYXNoIjoiY2JhZGZmOTJmYmU1ODAyZTUyZDJlNzg0NjViNjIzMWE0M2RmZjIxNGQwMzA3ZWU4MzRmZGZlNmE5ODA2MmQ1OCIsInNhbHQiOiJoWDhqQTMxa00ifQ=='
--data-raw '{
    "bearer": "01835fd6ad5672e5944bbfe74bedd5e376aba016149b4b92a7efc397d78c6fbe"
}'

#Response

{
    "token": {
        "token": "01835fd6ad5672e5944bbfe74bedd5e376aba016149b4b92a7efc397d78c6fbe",
        "scopes": [
            "*"
        ],
        "user_id": "sandbox-user",
        "client_id": "sandbox",
        "expires_at": "2023-12-08T21:52:46-05:00"
    }
}

#Breakdown

#Request

In the above example, we make a POST request to https://api.ssofy.com/v1/authenticated/verify. This is the URL we need to request in order to verify tokens. The initial part of the URL https://api.ssofy.com may differ based on the application region. Replace it with the API domain of your application.

bearer, which is the token that needs to be verified, is contained in the message body's json payload.

#Headers

Content-Type: application/json

Specifying the format of our request body (json in our case).

Accept: application/json

Emphasize the need for a json response.

Api-Key: cf47d697-cc0b-4262-8329-78a0995e6fd0

API Key for your application provided on the application edit page.

Signature: eyJoYXNoIjoiY2JhZGZmOTJmYmU1ODAyZTUyZDJl...

Base64 encoding of the signature and salt generated for the request. More Info

#Response

SSOfy replies with a JSON payload with the details of the authorization. The scopes property contains a list of all the permissions the user has granted throughout the authorization process.

expires_at indicates when the token will expire. When caching a token, be sure to set a ttl (expiration time) that is equal to or less than this value.

The Signature header, which should be verified for enhanced security, is also included in the response headers.

#Caching

SSOfy can send an event to the designated event URL to alert your application when a token is deleted.

The performance of your token verification will therefore be improved if you consider using a cache mechanism to lower the number of times you need to repeatedly access the SSOfy server. You might also benefit from saving account triggers.

Simply invalidate your cached state after receiving a token delete event.