> For the complete documentation index, see [llms.txt](https://docs.vida.id/identity-stack/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.vida.id/identity-stack/verify/kyc-web-sdk/integration/frontend-integration/authentication.md).

# Authentication

The Vida Web SDK requires authentication through a **Vida SSO-generated bearer token**. This token verifies that the request originates from an authorized and legitimate source.

Obtaining the Bearer Token

To generate the token, you will need: ( These are pre shared with you )

1. `client_id`: A unique identifier provided to you.
2. `client_secret`: A unique secret key configured for you.

These credentials must be passed to the **Token API endpoint** to obtain the access token.

1. **Sandbox API Endpoint**:

   `https://qa-sso.vida.id/auth/realms/vida/protocol/openid-connect/token`
2. **Production API Endpoint**:

   `https://sso.vida.id/auth/realms/vida/protocol/openid-connect/token`

Example: Generating the Token Using cURL

`curl --location --request POST 'https://qa-sso.vida.id/auth/realms/vida/protocol/openid-connect/token' \ --header 'Authorization: Basic {{auth}}' \ --header 'Content-Type: application/x-www-form-urlencoded' \ --data-urlencode 'grant_type=client_credentials' \ --data-urlencode 'scope=roles' \ --data-urlencode 'client_id=XXXXXX' \ --data-urlencode 'client_secret=XXXXXX'`

1. Replace `XXXXXX` with the actual `client_id` and `client_secret` provided.
2. The API will return an **HTTP Status Code: 200** upon success.

<details>

<summary>Example JSON Response</summary>

```json
{ "access_token": "eyJhbGciOiJSb5J4ZTZ…", "expires_in": 18000, 
"refresh_expires_in": 1800, "token_type": "Bearer", "not-before-policy": 
1621349762, "session_state": "98ffa630-af77-4312-b4b87fc", "scope": "" }
```

</details>

Use the `access_token` from the response as an input for the SDK's `init` method.

| Environment | Token Validity |
| ----------- | -------------- |
| Production  | 5 minutes      |
| Sandbox     | 5 hours        |

#### Secure Storage and API Call Recommendations <a href="#secure-storage-and-api-call-recommendations" id="secure-storage-and-api-call-recommendations"></a>

1. **Server-Side Storage**: Ensure `client_id`, `client_secret` are stored securely on your server. Do not expose these credentials on the client side.
2. **Server-to-Server Communication**: The API call to obtain the bearer token must be made from your server to Vida's server.
3. **Signing Key**: Along with the `client_id` and `client_secret`, Vida will pre-share a **signing key**. Store this securely on your server and pass it along with the obtained token to the SDK's `init` method.<br>

When initializing the Vida SDK:

1. Obtain the bearer token using the provided credentials.
2. Retrieve the securely stored signing key.
3. Pass both the token and signing key to the SDK's `init` method.

This ensures a secure and authenticated interaction between your application and the Vida services.