Authentication & Token API

Endpoints autentikasi aplikasi klien. Ini jalur masuk dazo-whitelist untuk mendapatkan Passport Bearer Token via RSA signature. Sebagian besar endpoint di grup ini publik (tidak butuh Bearer token), karena justru untuk mendapat token.

GET /api/application — Info aplikasi klien

Handler: ApplicationController::index (dazo-whitelist-api)

GEThttp://127.0.0.1:8081/api/application

curl --request GET \
  --url http://127.0.0.1:8081/api/application

$response = Invoke-WebRequest -Uri 'http://127.0.0.1:8081/api/application' -Method GET

const url = 'http://127.0.0.1:8081/api/application';
const options = {method: 'GET'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

const fetch = require('node-fetch');

const url = 'http://127.0.0.1:8081/api/application';
const options = {method: 'GET'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

import requests

url = "http://127.0.0.1:8081/api/application"

response = requests.get(url)

print(response.json())

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "http://127.0.0.1:8081/api/application"

	req, _ := http.NewRequest("GET", url, nil)

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_PORT => "8081",
  CURLOPT_URL => "http://127.0.0.1:8081/api/application",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

Ambil info aplikasi klien. Memakai header x-user, x-app, x-signature (berbeda dari handshake token).

Request headers

Header	Wajib	Tipe	Keterangan
`x-user`	✅	UUID	ID user API engine
`x-app`	✅	UUID	ID aplikasi (`Application.id`)
`x-signature`	✅	string	RSA signature dari payload `[user.id, user.created_at, app.id, app.secret]`

Response

json

&#123;
  "status": true,
  "data": &#123;
    "x-client-key": "UUID",
    "x-client-secret": "secret",
    "private_key": "-----BEGIN PRIVATE KEY-----",
    "public_key": "-----BEGIN PUBLIC KEY-----"
  &#125;
&#125;

Error

Status	Kondisi
400	Validasi header gagal
401	User tidak ditemukan
404	`Invalid app` / `Invalid Signature`

GET /api/application/token — RSA Handshake (mendapat token)

Handler: ApplicationController::token (dazo-whitelist-api)

GEThttp://127.0.0.1:8081/api/application/token

curl --request GET \
  --url http://127.0.0.1:8081/api/application/token

$response = Invoke-WebRequest -Uri 'http://127.0.0.1:8081/api/application/token' -Method GET

const url = 'http://127.0.0.1:8081/api/application/token';
const options = {method: 'GET'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

const fetch = require('node-fetch');

const url = 'http://127.0.0.1:8081/api/application/token';
const options = {method: 'GET'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

import requests

url = "http://127.0.0.1:8081/api/application/token"

response = requests.get(url)

print(response.json())

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "http://127.0.0.1:8081/api/application/token"

	req, _ := http.NewRequest("GET", url, nil)

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_PORT => "8081",
  CURLOPT_URL => "http://127.0.0.1:8081/api/application/token",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

Endpoint kunci — tukar RSA signature menjadi Passport Bearer Token. Ini dipanggil oleh App\Src\MyApi::get_token() di web app.

Middleware: Publik (tidak butuh Bearer token — ini jalur untuk mendapatkannya).

Request headers

Header	Wajib	Tipe	Keterangan
`x-client-key`	✅	UUID	ID aplikasi (`Application.id`)
`x-signature`	✅	string	RSA SHA-256 signature
`x-timestamp`	✅	string	ISO8601 `Y-m-d\TH:i:sP` — toleransi ±10 menit

Payload signature (client side)

php

$data = implode('|', [
    $client_key,     // Application.id
    $private_key,    // Application.private_key (BUKAN public_key!)
    $client_secret,  // Application.secret
    $timestamp,      // x-timestamp
]);
openssl_sign($data, $sig, private_key.pem, OPENSSL_ALGO_SHA256);
$x_signature = base64_encode($sig);

Response sukses

json

&#123;
  "status": true,
  "data": &#123;
    "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOi..."
  &#125;
&#125;

Error

Status	Kondisi
400	Validasi input gagal / `Invalid Timestamp` (di luar ±10 min)
404	`Invalid app` / `Invalid Signature`

Aksi server (ApplicationController::token)

Validasi x-client-key (uuid), x-signature (required), x-timestamp (ISO8601)
Parse timestamp & cek between(now-10min, now)
Lookup Application by x-client-key; pastikan public_key ada
Rebuild payload server-side & openssl_verify
Issue Passport Personal Access Token (2 jam TTL), revoke token lama

GET /api/application/graph — Info Graph API

Handler: ApplicationController::graph

GEThttp://127.0.0.1:8081/api/application/graph

curl --request GET \
  --url http://127.0.0.1:8081/api/application/graph

$response = Invoke-WebRequest -Uri 'http://127.0.0.1:8081/api/application/graph' -Method GET

const url = 'http://127.0.0.1:8081/api/application/graph';
const options = {method: 'GET'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

const fetch = require('node-fetch');

const url = 'http://127.0.0.1:8081/api/application/graph';
const options = {method: 'GET'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

import requests

url = "http://127.0.0.1:8081/api/application/graph"

response = requests.get(url)

print(response.json())

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "http://127.0.0.1:8081/api/application/graph"

	req, _ := http.NewRequest("GET", url, nil)

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_PORT => "8081",
  CURLOPT_URL => "http://127.0.0.1:8081/api/application/graph",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

Ambil info konfigurasi Graph API (version & related config).

Middleware: Publik

Response

json

&#123;
  "status": true,
  "data": &#123;
    "graph_version": "v20.0"
  &#125;
&#125;

POST /api/application/token/check — Validasi token

Handler: ApplicationController::checkToken

POSThttp://127.0.0.1:8081/api/application/token/check

curl --request POST \
  --url http://127.0.0.1:8081/api/application/token/check

$response = Invoke-WebRequest -Uri 'http://127.0.0.1:8081/api/application/token/check' -Method POST

const url = 'http://127.0.0.1:8081/api/application/token/check';
const options = {method: 'POST'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

const fetch = require('node-fetch');

const url = 'http://127.0.0.1:8081/api/application/token/check';
const options = {method: 'POST'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

import requests

url = "http://127.0.0.1:8081/api/application/token/check"

response = requests.post(url)

print(response.json())

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "http://127.0.0.1:8081/api/application/token/check"

	req, _ := http.NewRequest("POST", url, nil)

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_PORT => "8081",
  CURLOPT_URL => "http://127.0.0.1:8081/api/application/token/check",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

Cek keaktifan access token.

Middleware: Publik

Request body

Field	Wajib	Tipe
`token`	✅	string

Response

json

&#123;
  "status": true,
  "valid": true
&#125;

POST /api/application/token/exchange — Tukar kredensial

Handler: ApplicationController::exchangeToken

POSThttp://127.0.0.1:8081/api/application/token/exchange

curl --request POST \
  --url http://127.0.0.1:8081/api/application/token/exchange

$response = Invoke-WebRequest -Uri 'http://127.0.0.1:8081/api/application/token/exchange' -Method POST

const url = 'http://127.0.0.1:8081/api/application/token/exchange';
const options = {method: 'POST'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

const fetch = require('node-fetch');

const url = 'http://127.0.0.1:8081/api/application/token/exchange';
const options = {method: 'POST'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

import requests

url = "http://127.0.0.1:8081/api/application/token/exchange"

response = requests.post(url)

print(response.json())

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "http://127.0.0.1:8081/api/application/token/exchange"

	req, _ := http.NewRequest("POST", url, nil)

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_PORT => "8081",
  CURLOPT_URL => "http://127.0.0.1:8081/api/application/token/exchange",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

Menukar kredensial token.

Middleware: auth:api, myapi — membutuhkan Bearer token yang valid + header public-key.

Request headers

Header	Wajib	Keterangan
`Authorization`	✅	`Bearer {token}`
`public-key`	✅	File contents `public_key.pem`

Ringkasan dasar auth

Endpoint	Method	Middleware	Fungsi
`/api/application`	GET	Publik	Info aplikasi (x-user/x-app/x-signature)
`/api/application/token`	GET	Publik	RSA handshake → Bearer token
`/api/application/graph`	GET	Publik	Info Graph version
`/api/application/token/check`	POST	Publik	Validasi token aktif
`/api/application/token/exchange`	POST	`auth:api, myapi`	Tukar kredensial

Langkah berikutnya

Pahami alur handshake penuh (401 retry loop)? Baca RSA Handshake deep-dive.
Pakai token untuk akses Facebook data? Lihat Facebook OAuth & BM.
Kembali ke API Reference.