User agent flow without User-Profile-Endpoint

Need help APIs
1

I believe the API I’m working with does not provide a dedicated user endpoint. Before I invest more time into the User-Agent Flow, I want to confirm whether this authentication method is still appropriate if no user endpoint is available. The documentation suggests that user information is only included in the response when the access token is issued. Would this still align with the expected OAuth2 flow?

Additionally: API requires signing with HMAC-SHA1 and follows the OAuth2 protocoll.

2

Solved, it had to do it maually with serverscript doesnt really work with basic bubble or any plugins everytime/case sensitive

3

You can do it with “basic” bubble but manually and not using bubble user-agent flow:

4

Yes what i didnt mentioned, sorry for that, was that is had to encrypt the sorted aprameters with their values in ascii for the sign with an unsix (ms) timestamp and the api path/name, that sadly didnt work in bubble but thank you very much for that post i just took a look and it looks really promising for another api i might gonna be needing.

But do you might happen to know if there s a plugin or possibility to create a sign (individually for each request) without raw code?

this is what iam currently doing:

function run_script(properties, context) {
  var crypto = require('crypto');

  // 1) Get values from Bubble
  var 1       = properties.thing3; 
  var 2  = properties.thing1; 
  var 3       = properties.thing2;  
  var 4 = properties.thing4;

  // 2) Validate 1 before using it
  if (!secret) {
    throw new Error("Missing secret key (thing3 is null or undefined)");
  }

  // 3) Generate timestamp in milliseconds
  var timestamp = new Date().getTime(); 

  // 4) Create sign 
  var sign_method = "sha256";
  var str = "/rest/auth/token/apiPathName" +
            "parameter" + thing1 +
            "parameter..."      + thing2 +
            "parameter" + thing.... + 
            "parameter"  + ... +
            "parameter"    + ....;

  // 5) Generate the HMAC-SHA256 signature
  var signature = crypto.createHmac('sha256', secret)
                        .update(str)
                        .digest('hex')
                        .toUpperCase();

  return {
    output1: timestamp, // Correct timestamp in milliseconds
    output2: signature  // Computed SHA256 HMAC signature
  };
}

run_script(properties, context);
5

In this case, this is not an user-agent / authorization code oAuth2 workflow but oAuth1 auth probably

6

Yes i thought the same but the Docs point out that it follows OAuth2 protocoll, … so confusing :DD

screenshot
screenshot736×143 8.31 KB

7

I don´t want to bother you, but do you know if the AccessToken is Refreshed for the User in the live app or do they have to login again after expiration of the access token? Does the user Agent Flow handle that?

8

user agent flow handle that yes. Only API Connector doesn’t refresh token. When you use manual process, you need to also handle this part.

9

Thank you, i thought so but wasnt actually sure :sweat_smile: