You can use Vanilla's JWT addon to authenticate against the API v2 in addition to the normal web SSO flow.
What Is a JWT?
JWT stands for JSON Web Token. JSON Web Tokens are an open, industry standard RFC 7519 method for representing claims securely between two parties. In order to use this authentication you will need to create a JWT and pass it as a bearer token for API calls. For more information about JWTs in general, see jwt.io.
Information You'll Need For Your JWTs
There is some specific information you'll need for the JWT.
Header
typ hardcoded to "JWT"alg one of three valid HMAC hashing algorithms. We support: "HS256", "HS512", and "HS384".
Payload
iss the issuer (usually the domain of the Authentication Provider).sub a unique identifier passed that will always accompany the user when he/she logs in. This is the UniqueID in regular SSO.aud The intended audience (usually the URL of the forum).email The email address of the user.displayname The username to be displayed on the site.exp The expiry time of the token (unix time stamp).- Either
iat or nbf unix time stamp when the token was created. We will reject any token that doesn't have one or has one set in the future.
The payload can optionally include:
picture The URL of a profile picture displayed on the site. If one is not present the user can upload one afterwards.
Signing the JWT
You sign your JWT with the same secret in the JWT settings. Make sure this secret stays on your server or else your authentication can become compromised. If your secret ever gets leaked we strongly recommend changing it immediately.
Passing the JWT to API Calls
You pass the JWT in the header as an RFC 6750 bearer token in the Authorization header:
Authorization: Bearer <JWT Here>
Note the space between the word "Bearer" and the actual JWT.
Using a JWT Without SSO
Sometimes you may use another SSO method for the web flow, but still want to use a JWT for API calls.
There is currently no official way to disable the regular JWT SSO, but if your main SSO method is set to the default you won't see the JWT sign in button on your site. We will be adding a config option to disable the JWT SSO web flow in the near future.