Confused by App key and app secret authentication

[udliveio]

Hi,

I've been trying to understand how we can use the APP authentication in fusio. So far we haven't managed to figure it out.

So we have generated the key and secret:

From the developer app documentation I would suspect these would be my URLs

Authorization-Endpoint /developer/auth Token-Endpoint /authorization/token

That's what we have setup in insomnia

But we get an error

{
    "success": false,
    "title": "Internal Server Error",
    "message": "Unknown location"
}

Basically I'm a bit confused what goes in "authorization url" and what goes in "access token url"

The bearer approach with JWT token works absolutely fine.

Kind Regards

[chriskapp]

Hi, so the authorization url should point to the developer app. The developer app is located at the apps/ folder. So depending on your setup this is i.e. apps.acme.com/developer/auth in case you have a custom vhost for your apps.

[udliveio]

Hi Christoph,

That's handy to know.

Is it also possible to use App authentication without the developer app or is it a must?

I was wondering, mainly due to the fact that the App key and secret can be generated from fusio management app.

Thank you

On Sun, 22 Nov 2020 at 18:38, Christoph Kappestein notifications@github.com wrote:

Hi, so the authorization url should point to the developer app. The developer app is located at the apps/ folder. So depending on your setup this is i.e. apps.acme.com/developer/auth in case you have a custom vhost for your apps.

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/apioo/fusio/issues/349#issuecomment-731809187, or unsubscribe https://github.com/notifications/unsubscribe-auth/ARLMYIWTT33OXWGCSWW4SXTSRFLA3ANCNFSM4T6QT3BA .

--

[image: DMS / UDD] https://www.linkedin.com/in/raivis-strogonovs-23689926/ Raivis Strogonovs | Head Of Engineering +44 (0)7774 023556 raivis@udlive.io [image: Learn more at https://www.udlive.io] https://www.udlive.io/ [image: Check us out on LinkedIn] https://www.linkedin.com/company/uda-live/ [image: Check us out on Twitter] https://twitter.com/DMSLive1

-- Disclaimer:

The content of this email is confidential and intended for 

the recipient specified in message only. It is strictly forbidden to share any part of this message with any third party, without a written consent of the sender. If you received this message by mistake, please reply to this message and follow with its deletion, so that we can ensure such a mistake does not occur in the future. The security of customers and suppliers as a priority. Therefore, we have put efforts into ensuring that the message is error and virus-free. Unfortunately, full security of the email cannot be ensured as, despite our efforts, the data included in emails could be infected, intercepted, or corrupted. Therefore, the recipient should check the email for threats with proper software, as the sender does not accept liability for any damage inflicted by viewing the content of this email. 

No employee has the authority to conclude any binding contract without an explicit written consent of their supervisor. Therefore, any will to enter into an agreement must be confirmed by a second manager or director. Any quotation contained is sent to compare available offers and does not imply entering into a legally binding contract.  Please do not print this email unless it is necessary. Every unprinted email helps the environment. The views and opinions included in this email belong to their author and do not necessarily mirror the views and opinions of the company. Our employees are obliged not to make any defamatory clauses, infringe, or authorise infringement of any legal right. Therefore, the company will not take any liability for such statements included in emails. In case of any damages or other liabilities arising, employees are fully responsible for the content of their emails.