auth

Authentication & Authorization

Authentication

To be able to use most endpoints of this api you will require an access token. This can be obtained at the /token endpoint

POST: /token

Try is out here: Link

This endpoint unlike most (that use application/json), uses application/x-www-form-urlencoded as the content type. So when submitting the details its done like username=<username>&password=<password>&scope=[scopes]

Arguments:

Username:
(string) Username to the account

Password:
(string) Password to the account

Scopes:

Each user has a default set of permissions which is things they can do with the API (see Permissions section under Users for info on each one). If a user requires additional permissions that are not in the default set of permissions they can request them. This is done by adding the scopes wanted to the scopes parameter when requesting a token.

Scopes List:

• "create_rooms": The ability to create chatrooms
• "delete_self": Permission to delete the current user/delete your own account
• "mofify_self": Be able to modify your own account

Image of schema:

Example Request:

curl -X 'POST' \
  'https://chatapi.fusionsid.xyz/token' \
  -H 'accept: application/json' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'username=<username>&password=<password>&scope=[scopes]'

Example Response:

// status code: 200
{
  "access_token": "string", // Your access token
  "token_type": "string" // should be: "Bearer"
}

Note:
If you don't want to request any scopes you can just do &scope=

---

Access Tokens

Access tokens for users are of type Bearer. This prefix should be include when the endpoint needs the token in the header (see authorization bellow).

The access tokens are JWT (json web tokens). They are signed so modifying them automatically makes them invalid.
Payload of the token is user_id, scopes (if none empty list), and expiry time.

Access tokens expire in 1440 minutes (24 hours / 1 day) after they were created.

---

Authorization:

For all HTTP endpoints that require authentication, the access_token is put into the Authorization HTTP header.

Format:

{
    "Authorization": "Bearer [access_token]"
}

Example:

curl -X 'GET' \
  'https://chatapi.fusionsid.xyz/api/user/me' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer super_secret_access_token'