> For the complete documentation index, see [llms.txt](https://docs.vida.id/identity-stack/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.vida.id/identity-stack/verify/id-fraud-shield-sdk/integration-guide/web-sdk/authentication.md).

# Authentication

The Vida Web SDK requires authentication through a **Vida SSO-generated bearer token**. This token verifies that the request originates from an authorized and legitimate source.

Obtaining the Bearer Token

To generate the token, you will need: ( These are pre shared with you )

1. `client_id`: A unique identifier provided to you.
2. `client_secret`: A unique secret key configured for you.

These credentials must be passed to the **Token API endpoint** to obtain the access token.

1. **Sandbox API Endpoint**:

```java
https://qa-sso.vida.id/auth/realms/vida/protocol/openid-connect/token
```

2. **Production API Endpoint**:

```java
https://sso.vida.id/auth/realms/vida/protocol/openid-connect/tokenhttps://sso.vida.id/auth/realms/vida/protocol/openid-connect/token
```

Example: Generating the Token Using cURL

```json
curl --location --request POST 'https://qa-sso.vida.id/auth/realms/vida/protocol/openid-connect/token' \
--header 'Authorization: Basic {{auth}}' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'scope=roles' \
--data-urlencode 'client_id=XXXXXX' \
--data-urlencode 'client_secret=XXXXXX'
```

 

1. Replace `XXXXXX` with the actual `client_id` and `client_secret` provided.
2. The API will return an **HTTP Status Code: 200** upon success.

**Example JSON Response**

```json
{
    "access_token": "eyJhbGciOiJSb5J4ZTZ…",
    "expires_in": 18000,
    "refresh_expires_in": 1800,
    "token_type": "Bearer",
    "not-before-policy": 1621349762,
    "session_state": "98ffa630-af77-4312-b4b87fc",
    "scope": ""
}
```

 

Use the `access_token` from the response as an input for the SDK's `init` method.

| Environment | Token Validity |
| ----------- | -------------- |
| Production  | 5 minutes      |
| Sandbox     | 5 hours        |

#### Secure Storage and API Call Recommendations <a href="#secure-storage-and-api-call-recommendations" id="secure-storage-and-api-call-recommendations"></a>

1. **Server-Side Storage**: Ensure `client_id`, `client_secret` are stored securely on your server. Do not expose these credentials on the client side.
2. **Server-to-Server Communication**: The API call to obtain the bearer token must be made from your server to Vida's server.
3. **Signing Key**: Along with the `client_id` and `client_secret`, Vida will pre-share a **signing key**. Store this securely on your server and pass it along with the obtained token to the SDK's `init` method.\ <br>

When using the submitData method of SDK:

1. Obtain the bearer token using the provided credentials.
2. Retrieve the securely stored signing key.
3. Pass both the token and signing key to the SDK's `submitData` method.

This ensures a secure and authenticated interaction between your application and the Vida services.