10.2 Authenticating to the MyID Core API

The MyID Core API (rest.core) requires authentication through the MyID web.oauth2 service.

You must configure the web.oauth2 service to add a new client to be used by your website, and configure it to allow end-user authentication.

10.2.1 Adding the API client

The sample API website uses a new client called myid.mywebsite – you must add this client to the configuration of the web.oauth2 service.

First, create a custom client configuration file.

1. On the MyID web server, navigate to the CustomClients folder.

   By default, this is:

   C:\Program Files\Intercede\MyID\web.oauth2\CustomClients\

   If this folder does not already exist, create it.

2. In a text editor, create a .json file to contain your client configuration.

   You can use any filename with a .json extension; you are recommended to use the name you have provided for the client as the filename.

   You can create a custom .json file for each client that you want to add. You can include only one client in each file, but you can have multiple files if you need multiple clients. These clients are added to the Clients array from the appsettings.json file. You must use a unique ClientID; if you use the same ClientID in a custom file as an already existing client in the appsettings file, the information from the custom file completely replaces the information in the appsettings.json or appsettings.Production.json override file.

   The order of precedence is:

   • any .json file in the CustomClients folder.

   • appsettings.Production.json

   • appsettings.json

   Note: The appsettings.Production.json file overrides the appsettings.json file not by using the client ID, but by the index of the entry in the Clients array. For this reason, you are recommended not to use the appsettings.Production.json file to provide the details of custom clients, but to use separate files in the CustomClients folder instead.

Now that you have a custom client configuration file, you can edit it to add your client details:

{
    "ClientId": "myid.mywebsite",
    "ClientName": "My Website",
    "AccessTokenLifetime": "3600",
    "AllowedGrantTypes": [
        "authorization_code"
    ],
    "RequireClientSecret": false,
    "RequirePkce": true,
    "AllowAccessTokensViaBrowser": true,
    "RequireConsent": false,
    "AllowedScopes": [
        "myid.rest.basic"
    ],
    "RedirectUris": [
        "<website URL>"
    ],
    "AllowedCorsOrigins": [
        "<website origin>"
    ]
}

Where:

• <website URL> – the location of the website to which the authentication server will return the authorization code. In this single-page example, this is the same URL as you use to request the authorization code.

  If you have multiple web pages on your website to which you want the authentication server to return an authorization code, you can add them to this array, separated by commas; for example:

  Copy

  "RedirectUris": [
    "http://127.0.0.1:5500/",
    "http://127.0.0.1:5500/page1.html",
    "http://127.0.0.1:5500/page2.html"
  ],

  For this worked example, however, you keep reusing the same index.html file, so if you are using the Live Server extension for Visual Studio Code as your local web server, you can use:

  Copy

  "RedirectUris": [
    "http://127.0.0.1:5500/"
  ],

• <website origin> – used for Cross-Origin Resource Sharing (CORS). If the web page that calls the authentication service is on a different web server from the authentication service, you must add the origin to this list.

  Note: Make sure you use an origin, and not an URL, when configuring CORS. For example: https://myserver/ is an URL, while https://myserver is an origin – there is no trailing slash on an origin.

  For this worked example, if you are using the Live Server extension for Visual Studio Code as your local web server, you can use:

  Copy

  "AllowedCorsOrigins": [
      "http://127.0.0.1:5500"
  ]