Step 3 - Retrieving a JWT

Now that the signing is in place, a call can be done to our /auth/token endpoint to obtain a JWT. This JWT (‘token’) is used as a bearer token for authenticating subsequent calls to other APIs, and is bound to a specific user resource:

 {
    url: 'auth/token',
    method: 'post',
    data: '{"tenantUserId":"user674638475"}',
    headers: {
      Accept: 'application/json',
      'Content-Type': 'application/json',
      'X-API-Key': '', //Api Key provided to you by Ockto
      Digest: 'SHA-256=6DwEbPZWyLI71/uhdjgJ3zO6v+YXcOjuwfxyUeZw1LM=',
      Date: 'Wed, 29 Sep 2021 11:36:06 GMT',
      Authorization: 'algorithm="rsa-sha256",headers="(request-target) date content-type accept digest",signature=k8EA8fN4VvP4oD4Dik3hKuTZ4p92VXkETkvvcKD+NdPzIf7xOERB5tSO9i05jWAxEs7Y0tQWAj2sYprOrI7uYGQsnh+9QZ0TJ1RU1//BriEXuTjNpwtgOfB4XpyN+qL1Tg2qwhrtssG7u11uq/g2RuUOc6j/bwcRkY68ID2uMyEKAfk46eEoZWvhuhybQERRSaCQati1REGQ0rgwITyApZbT2OicO9SdlEKnq3ztCLVtPfWyioFBz1EXM0d/yciKZxeaweAN250z0OnaPTlz3eiV15bzVVGKfhMKKKMBwWzLxlQRLtBASoWIoxgrUJj+umfDCexntHPVOvoJnZrEIQ==',
      'User-Agent': 'axios/0.21.4',
      'Content-Length': 21
    }
}

The API key required under the ‘X-API-KEY’ header will be provided to you by Ockto as part of the exchanging of public keys.

When requesting the JWT, a tenantUserId is required in the POST call. We will subsequently adapt this ID in our system, which allows you to bring your own user IDs for consistency.

{
"tenantUserId": "user674638475"
}

Request parameter in your POST call to /token

{
   token: "some-jwt-token"
   user_id: "test_app_user674638475"
   tenant_user_id: "user674638475"
   tenant_id: "test"
   tenant_app_id: "app"
}

API response