Authentication

The Vida Web SDK requires authentication through a Vida SSO-generated bearer token. This token verifies that the request originates from an authorized and legitimate source.

Obtaining the Bearer Token

To generate the token, you will need: (These are pre shared with you)

Parameter	Description
client_id	A unique identifier provided to you.
client_secret	A unique secret key configured for you.

These credentials must be passed to the Token API endpoint to obtain the access token.

Sandbox

https://qa-sso.vida.id/auth/realms/vida/protocol/openid-connect/token

Production

https://sso.vida.id/auth/realms/vida/protocol/openid-connect/token

Example: Generating the Token Using cURL

curl --location --request POST 'https://qa-sso.vida.id/auth/realms/vida/protocol/openid-connect/token' \ --header 'Authorization: Basic {{auth}}' \ --header 'Content-Type: application/x-www-form-urlencoded' \ --data-urlencode 'grant_type=client_credentials' \ --data-urlencode 'scope=roles' \ --data-urlencode 'client_id=XXXXXX' \ --data-urlencode 'client_secret=XXXXXX

1. Replace XXXXXX with the actual client_id and client_secret provided.

2. The API will return an HTTP Status Code: 200 upon success.

Example JSON Response

{ "access_token": "eyJhbGciOiJSb5J4ZTZ…", "expires_in": 18000, 
"refresh_expires_in": 1800, "token_type": "Bearer", "not-before-policy": 
1621349762, "session_state": "98ffa630-af77-4312-b4b87fc", "scope": "" }

Use the access_token from the response as an input for the SDK's init method.

Environment	Token Validity
Production	5 minutes
Sandbox	5 hours

Secure Storage and API Call Recommendations

1. Server-Side Storage: Ensure client_id, client_secret are stored securely on your server. Do not expose these credentials on the client side.

2. Server-to-Server Communication: The API call to obtain the bearer token must be made from your server to Vida's server.

3. Signing Key: Along with the client_id and client_secret, Vida will pre-share a signing key. Store this securely on your server and pass it along with the obtained token to the SDK's init method.

When initializing the Vida SDK:

1. Obtain the bearer token using the provided credentials.

2. Retrieve the securely stored signing key.

3. Pass both the token and signing key to the SDK's init method.

This ensures a secure and authenticated interaction between your application and the Vida services.