Jet Requests Auth
When working with your custom APIs it can be necessary to validate that request is done by the authenticated user and that the user is authorized to perform such requests.
You can send current user JWT token to your API to validate user and check permissions. Usually it is done with Authorization header, but you are free to use any implementation.
There are two types of user tokens:
token - generated per User, contains user ID in payload
project token - generated per App (and environment), contains user ID, project ID, environment ID, permissions, user properties, team properties
Validate JWT token
JSON Web Tokens are an open, industry standard RFC 7519 method for representing claims securely between two parties. There a lot of libraries across different languages and tech stacks which allow you to validate JWT token. JWT token also contains payload where you can find user info and permission details.
Here is the public key which you should use to validate that received token is correct token generated by Jet Admin side.
Check JWT permissions (project token)
If you want to give access to your API based on Jet Admin user permission you can parse JWT payload to get user permissions and check them. In this case you should use project token.
You can parse project token payload using https://jwt.io/
Example of project token payload with Full Access permissions:
Example of project token payload with granular permissions:
permissions key is a JSON object which is compressed with Gzip and Base64 encoded string. It contains detailed information about permissions which has user's assigned team.
Last updated
Was this helpful?