🚀 API authorization in API Maker

Authorization Process flow chart diagram

API Maker has define the authorization settings based on API categories. The main API categories are,

1. Instance API access settings
2. Third party API access settings
3. System API access settings
4. Custom API access settings
5. Secret access settings

Here, we discuss about all the APIs authorization settings in details.

Instance API access settings

At the instance, user can define the access settings in three different level.

• API settings
• Collection settings
• Database settings

If the access settings are not provided it will check for the default access settings in secret.

apiAccessType: IS_PUBLIC | TOKEN_ACCESS

There are two possible values of apiAccessType.

• When you set IS_PUBLIC this API should be publicly available.
• When you set TOKEN_ACCESS this API should require a token to access.
• Provide API User token in the x-am-authorization header.

Third party API access settings

User can define the API access settings at API and API Version level.

• When users provide access settings at the API level, it should be applied only to that particular API.
• The access settings provided at the API version level should apply to all APIs available in that API version.

If the access settings are not provided it will check for the default access settings in secret.

apiAccessType: IS_PUBLIC | TOKEN_ACCESS

• When you set IS_PUBLIC this API should be publicly available.
• When you set TOKEN_ACCESS this API should require a token to access.

System API access settings

API Maker user can set the authorization settings in each of the system API.

If the access settings are not provided it will check for the default access settings in secret.

apiAccessType: IS_PUBLIC | TOKEN_ACCESS

• When you set IS_PUBLIC this API should be publicly available.
• When you set TOKEN_ACCESS this API should require a token to access.

Custom API access settings

Every custom API has the settings in which users can define the authorization. You can provide 'authTokenInfo' in the settings.

If the access settings are not provided it will check for the default access settings in secret.

apiAccessType: IS_PUBLIC | TOKEN_ACCESS

• When you set IS_PUBLIC this API should be publicly available.
• When you set TOKEN_ACCESS this API should require a token to

Secret access settings

All the above APIs does not have access settings it will check access setting of the default secret. If the access setting is available in the secret it will apply in that APIs.

• If there authTokenInfo is provided then in the common object of the secret, in every API user needs to provide the required token until it's not overridden.
• You can define the authTokenAM, authTokenAMDB and AWS, Azure, Google authorization details in the 'authTokenInfo'.
• API Maker users can also define the required token objects as we define in the above code AWS Token, Azure token, Google token which can be use in single-sign-on.

Database user authorization

• When it required to provide database user authorization you can set the below code in the setting.
• If the code is set in the default secret it's token required in every instance APIs.

    authTokenInfo: <T.IAuthTokenInfo[]>[
        {
            authTokenType: T.EAuthTokenType.AM_DB,
            authTokenAMDB: {
                "instance": "INSTANCE_NAME",
                "database": "DATABASE_NAME",
                "collection": "COLLECTION_NAME",
                "usernameColumn": "USER_NAME_COLUMN",
                "passwordColumn": "USER_PASSWORD_COLUMN"
            }
        }
    ],

AWS authorization

To get the value of request header x-aws-authorization, use g.req.auth.authAWS.
The auth AWS code provide in the settings.

Sample object

{
    "authTokenType": "AWS",
    "authTokenAWS": {
        "cognitoUserPoolId": "POOL_ID",
        "region": "YOUR_REGION",
        "tokenExpiration": 200,
        "tokenUse": "access",
        "sourceFieldOfUniqueId": "__TOKEN_OBJECT_FIELD_NAME__",
        "groupsDataSource": {
            "instance": "INSTANCE_NAME",
            "database": "DATABASE_NAME",
            "table": "COLLECTION_NAME",
            "targetFieldForUniqueId": "UNIQUE_COLUMN_NAME",
            "groupsColumn": "COMMA_SEPARATED_GROUPS",
            "select": {
                "COLUMN_NAME1": 1,
                "COLUMN_NAME2": 1
            }
        }
    }
}

• You will get 'cognitoUserPoolId', 'region' data are from the AWS.
• The 'sourceFieldOfUniqueId' is the field name which you will get after opening AWS token, mostly it holds user email address.
• Provide the groups name comma separated in the 'groupsColumn' field and provide the 'instance', 'database', 'table' from which that 'groupsColumn' exist.
• The 'targetFieldForUniqueId' is your database field which contains the exact same value as the 'sourceFieldOfUniqueId' has.
• In 'select' you can define the column name which you want to get in the response.

Azure authorization

• To get the value of request header x-azure-authorization, use g.req.auth.authAzure.

Sample object

{
    "authTokenType": "AZURE", 
    "authTokenAzureAD": {
        "appId": "__CLIENT_ID__",
        "tenant": "__TENANT_ID__",
        "audience": "",
        "issuer": "",
        "sourceFieldOfUniqueId": "__TOKEN_OBJECT_FIELD_NAME__",
        "groupsDataSource": {
            "instance": "INSTANCE_NAME",
            "database": "DATABASE_NAME",
            "table": "COLLECTION_NAME",
            "targetFieldForUniqueId": "UNIQUE_COLUMN_NAME",
            "groupsColumn": "COMMA_SEPARATED_GROUPS",
            "select": {
                "COLUMN_NAME1": 1,
                "COLUMN_NAME2": 1
            }
        }
    }
}

• You will get 'appId', 'tenant', 'audience' and 'issuer' data are from the Azure.
• The 'sourceFieldOfUniqueId' is the field name which you will get after opening Azure token, mostly it will be "preferred_username" because it holds user email address.
• Provide the groups name comma separated in the 'groupsColumn' field and provide the 'instance', 'database', 'table' from which that 'groupsColumn' exist.
• The 'targetFieldForUniqueId' is your database field which contains the exact same value as the 'sourceFieldOfUniqueId' has.
• In 'select' you can define the column name which you want to get in the response.

Google authorization

To get the value of request header x-google-authorization, use g.req.auth.authGoogle.

Sample object

{
    "authTokenType": "GOOGLE",
    "authTokenGoogle": {
        "clientId": "YOUR_CLIENT_ID",
        "sourceFieldOfUniqueId": "__TOKEN_OBJECT_FIELD_NAME__",
        "groupsDataSource": {
            "instance": "INSTANCE_NAME",
            "database": "DATABASE_NAME",
            "table": "COLLECTION_NAME",
            "targetFieldForUniqueId": "UNIQUE_COLUMN_NAME",
            "groupsColumn": "COMMA_SEPARATED_GROUPS",
            "select": {
                "COLUMN_NAME1": 1,
                "COLUMN_NAME2": 1
            }
        }
    }

}

• You will get 'clientId' data are from the Google.
• The 'sourceFieldOfUniqueId' is the field name which you will get after opening Google token, mostly it holds user email address.
• Provide the groups name comma separated in the 'groupsColumn' field and provide the 'instance', 'database', 'table' from which that 'groupsColumn' exist.
• The 'targetFieldForUniqueId' is your database field which contains the exact same value as the 'sourceFieldOfUniqueId' has.
• In 'select' you can define the column name which you want to get in the response.

To get more information about APIs authorization please refer youtube video.

Websites
https://apimaker.dev

Follow on twitter
https://twitter.com/api_maker

Linked In
https://www.linkedin.com/company/api-maker

Youtube channel of API Maker
https://www.youtube.com/@api_maker