There are scenarios where you would want to query your service from within the Kaizala card. While the APIs to be queried are public (without any authentication), you could query them directly. But, in case you want to secure your APIs to make sure the calls are made by the particular user from within the Kaizala card alone – you could use the Integration Service token. This post explains how you could generate this token and subsequently validate this on the service side.
Generating the Integration Service token
To generate the Integration Services token from within the card, you will need to call the method getIntegerationServiceToken exposed in the SDK (KASClient.js). Below is the screenshot of the API and the result printed from the developer tools console.
You could now pass this in your call to the API (as a header / in the body).
Validating the token
In order to identify if the API request is genuine, you will need to validate the token. This could be done by calling into the v1/users/me endpoint with the token as the accessToken in the header. Integration Service token’s validity is 30 mins.
This would give you the below details:
- id – Kaizala user id, a guid to identify the user
- name – name set by the user in the profile
- phoneNumber – phone number of the user
- pictureUrl – link to the profile picture
- actionPackageId – Id of the Kaizala card / action package from which the token was generated
You could then use this on the service side to validate if the token to authenticate / authorize the request.
Hope that was helpful. Let me know if you have any questions through the comments section. Thank you for reading!
By “You could then use this on the service side to validate if the token to authenticate / authorize the request.”, you mean use the id and name derived to validate?
LikeLike
Yes, the card id could be used to validate that the request is indeed coming from the authorized card. Additionally, the user details could be used to validate that the user is authorized too.
LikeLike
Jiw do I use KASClient to make a http request? I have a drop down that I want to bind with dynamic products is that possible?
LikeLike
Yes, this is possible. In case you are running into CORS issue while making the request using AJAX call, you can use the performHttpRequest API in KASClient SDK.
LikeLike
How to use action get user uploaded ‘Photo with Location’ in kaizala
LikeLiked by 1 person
Hi Piyush, can you elaborate on what you mean by use action? Scenario would be helpful.
LikeLike