You can use Higher Logic Vanilla's JWT addon to authenticate against the API v2, in addition to the normal web SSO flow.
What is a JWT?
JWT stands for JSON Web Token. JSON Web Tokens are an open, industry-standard RFC 7519 method for representing claims securely between two parties. In order to use this authentication, you must create a JWT and pass it as a bearer token for API calls. For more information about JWTs, see jwt.io.
Required JWT information
Let's look at the specific information you'll need for the JWT.
Header
typ - Hardcoded to JWT.alg - We support the HS256 HMAC hashing algorithms.
Payload
iss - The issuer (usually the domain of the Authentication Provider).sub - A unique identifier passed that will always accompany the user when they log in. This is the UniqueID in regular SSO.aud - The intended audience (usually the URL of the community).email - The email address of the user.displayname - The username to be displayed on the site.exp - The expiry time of the token (unix time stamp).- Either
iat or nbf - Unix time stamp when the token was created. We will reject any token that doesn't have one or has one set in the future.
The payload can optionally include:
picture - The URL of a profile picture displayed on the site. If one is not present, the user can upload one afterwards.
Signing the JWT
You sign your JWT with the same secret in the JWT settings.
🛑 IMPORTANT: Make sure this secret stays on your server or else your authentication may become compromised. If your secret ever gets leaked, we strongly recommend changing it immediately.
Passing the JWT to API calls
You pass the JWT in the header as an RFC 6750 bearer token in the Authorization header:
Authorization: Bearer <JWT Here>
Note the space between the word "Bearer" and the actual JWT.
Using a JWT without SSO
Sometimes you may use another SSO method for the web flow, but still want to use a JWT for API calls.
📝 NOTE: Currently, there's no official way to disable the regular JWT SSO, but if your main SSO method is set to the default you won't see the JWT sign in button on your site. We will be adding a config option to disable the JWT SSO web flow in the near future.