JWT-Help: Token Example

Example jwt token generation for passkit api v2

by duncan_passkit_com

HTML

<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css">
<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/rollups/hmac-sha256.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/enc-base64-min.js"></script>
<div class="container">
  <h2>This is an example token</h2>
  <p>
    Authenticate Passkit v2 Api Requests with:
  </p>
  <pre id="authToken" style="word-wrap: break-word;"></pre>
  <p>
    <a alt="Debug Token" id="debugLink" target="_blank"><img alt="Debug Token" src="http://jwt.io/assets/badge.svg"></a>
  </p>
  <p>
    Please note that this should only ever be used in backend servers, as storing your api_secret in frontend javascript code would reveal it to the public.
  </p>
  <p>
    More info on JWT <a href="https://auth0.com/learn/json-web-tokens/">here</a>
  </p>
</div>

JavaScript

// Short script to generate a basic jwt token and display it in the paragraph "authToken"

// Generates the jwt token from an api key and secret
var token = generateJWT("v2_api_key", "v2_api_secret")
  // please note that any api key and secret from v1 (create.passkit.com) will not work with v2
  // contact us through CherryPie.PassKit.net to find out more.

// The Authorisation header of the HTTP request contains "PKAuth " + token string
document.getElementById("authToken").innerHTML = ("PKAuth " + token).replace(' ', '&nbsp')
  // I replaced the space with a non breaking space purely for format reasons.
document.getElementById("debugLink").href = "https://jwt.io/#id_token=" + token

function generateJWT(key, secret) {
  //header should always contain this information, our v2 api currently only accepts HS256 encryption
  header = {
    "alg": "HS256",
    "typ": "JWT"
  }

  // get the current time in seconds
  var time_now = Math.floor(new Date().getTime() / 1000)
    /* For the expiry time, I've added 30 seconds, maximum allowed by our api is 1 minute, this is to ensure that if someone did intercept your api request, they would only be able to use your authorisation token for up to this time. 
    Feel free to make it shorter, the request should usually reach our system within a few seconds. */
  var exp = time_now + 30

  //the body should only contain the api key and expiry time
  body = {
    "exp": exp,
    "key": key
  }

  //create token variable
  var token = []
    // all parts of the token need to be base 64 url encoded
    // first part is generated from the JSON string of the header object 
  token[0] = base64url(JSON.stringify(header))
    // second part is generated from the JSON string of the body object 
  token[1] = base64url(JSON.stringify(body))
    // thirs part is generated from the hash of token[0] joined with token[1] by a dot "."
  token[2] = genTokenSign(token, secret)

  // the token itself is just the three sections joined with dots...