JSON Web Token

User token

When a user logs in A2 with a username and password, A2 returns the information of the user including a token. The user will need this token (which includes the role information of the user) in order to make requests to the back-end. Requests to the back-end will use JSON Web Tokens (JWT) on the header.

Example of use

Consider a user with the role developer who wants to create a new game for RAGE analytics. The first step will be to log-in through a POST request to http://your-ip:3000/api/# with both the username and password on the request body. In response, the developer will receive back from the A2 the user information including the unique token.

Then, the developer could create a new game through a POST request to http://your-ip:3000/api/proxy/gleaner/games containing the title of the game and whether the game is public or not. The header of this request has to contain an Authorization key with value Bearer <token>, where token is the token returned by A2 after log-in. This information added to the header determines whether the user has permission to make the desired request or not, and therefore whether the request will be fulfilled or rejected.

Information on which permissions each role has by default can be seen from the roles tab in the administration view or in the roles definition.