• API Client
  • How to Use
  • Token Verification
  • Query User Information
• Cache Invalidation

#API Client

Use API Client module for tasks like token verification, user info inquiry, and updating the configuration of your SSOfy application.

#How to Use

Start by setting up a ClientConfig instance with your credentials:

import { APIConfig } from "@ssofy/node-sdk";
...
const config = new APIConfig({
    'domain'     : 'api.us.ssofy.com',
    'key'        : 'YOUR API KEY',
    'secret'     : 'YOUR APPLICATION SECRET',
    'cacheStore' : null, // cache driver to use. default: null
    'cacheTtl'   : 10800, // time-to-live in seconds. default: 60 * 60 * 3
    'secure'     : true, // use https connection. default: true
};

It is highly recommended to specify a cache driver to enable the SDK to memorize verification results for a length of time in order to reduce response times by preventing round-trip queries to the SSOfy API.

You can kickstart with the built-in file-based cache driver. You might need to develop a custom implementation of the cache driver based on what works best for your application by implementing the Storage interface.

import { FileStorage } from "@ssofy/node-sdk";
...
const storagePath = fs.mkdtempSync('/tmp/');
const cache = new FileStorage(storagePath);

// and refine your config settings to use the cache driver
config.cache = cache;

We can now use the config to instantiate the APIClient:

import { APIClient } from "@ssofy/node-sdk";
...
const client = new APIClient(config);

#Token Verification

import { APIClient, Models } from "@ssofy/node-sdk";
...

/**
 * @type {Models.ApiResponse}
 */
const response = await client.verifyAuthentication('TOKEN');

Note: The token parameter may or may not be preceded by Bearer.

Most server-side applications expect the token in their request's Authorization header to begin with 'Bearer...'. The verifyAuthentication() method strips the prefix from your string automatically as it shouldn't be included when sent to the api for verification.

#Query User Information

SSOfy can be used to retrieve user information from the resource server if the servers or applications are different. (i.e. Microservice)

import { APIClient, Models } from "@ssofy/node-sdk";
...

/**
 * @type {Models.ApiResponse}
 */
const response = await client.authenticatedUser('TOKEN');

#Cache Invalidation

You should always invalidate the cached token once you receive a delete event in the webhook

import { APIClient } from "@ssofy/node-sdk";
...

client.invalidateTokenCache('TOKEN');

In case for some reason the cache for a particular token could not be erased or the events weren't delivered to your webhook, make sure to invalidate all tokens time-to-time to let the SDK reevaluate the verifications:

import { APIClient } from "@ssofy/node-sdk";
...

client.purgeTokenCache('TOKEN');