Authentication

The Vida Web SDK requires authentication through a Vida SSO-generated bearer token. This token verifies that the request originates from an authorized and legitimate source.

Obtaining the Bearer Token

To generate the token, you will need: (These are pre shared with you)

Parameter	Description
client_id	A unique identifier provided to you.
client_secret	A unique secret key configured for you.

These credentials must be passed to the Token API endpoint to obtain the access token.

Sandbox API Endpoint

https://qa-sso.vida.id/auth/realms/vida/protocol/openid-connect/token

Production API Endpoint

https://sso.vida.id/auth/realms/vida/protocol/openid-connect/tokenhttps://sso.vida.id/auth/realms/vida/protocol/openid-connect/token

Example: Generating the Token Using cURL

curl --location --request POST 'https://qa-sso.vida.id/auth/realms/vida/protocol/openid-connect/token' \
--header 'Authorization: Basic {{auth}}' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'scope=roles' \
--data-urlencode 'client_id=XXXXXX' \
--data-urlencode 'client_secret=XXXXXX'

1. Replace XXXXXX with the actual client_id and client_secret provided.

2. The API will return an HTTP Status Code: 200 upon success.

Sample Response

{
    "access_token": "eyJhbGciOiJSb5J4ZTZ…",
    "expires_in": 18000,
    "refresh_expires_in": 1800,
    "token_type": "Bearer",
    "not-before-policy": 1621349762,
    "session_state": "98ffa630-af77-4312-b4b87fc",
    "scope": ""
}

Use the access_token from the response as an input for the SDK's init method.

Environment	Token Validity
Production	5 minutes
Sandbox	5 hours

Secure Storage and API Call Recommendations

1. Server-Side Storage: Ensure client_id, client_secret are stored securely on your server. Do not expose these credentials on the client side.

2. Server-to-Server Communication: The API call to obtain the bearer token must be made from your server to Vida's server.

3. Signing Key: Along with the client_id and client_secret, Vida will pre-share a signing key. Store this securely on your server and pass it along with the obtained token to the SDK's init method.

When using the submitData method of SDK:

1. Obtain the bearer token using the provided credentials.

2. Retrieve the securely stored signing key.

3. Pass both the token and signing key to the SDK's submitData method.

This ensures a secure and authenticated interaction between your application and the Vida services.