Consume internal API on behalf of a citizen ¶

This how-to guides you through the steps required to consume an API secured with TokenX:

Prerequisites ¶

Your application receives requests with a citizen subject token in the Authorization header
- The subject token can either be from ID-porten or from TokenX itself
The API you're consuming has granted access to your application

Configure your application ¶

Enable TokenX in your application:

app.yaml

spec:
  tokenx:
    enabled: true

Depending on how you communicate with the API you're consuming, configure the appropriate outbound access policies:

Service discovery External addresses

app.yaml

spec:
  accessPolicy:
    outbound:
      rules:
        - application: <some-api>
          namespace: <some-team>

app.yaml

spec:
  accessPolicy:
    outbound:
      external:
        - host: <some-host>

Exchange token ¶

Send a HTTP POST request to the endpoint found in the NAIS_TOKEN_EXCHANGE_ENDPOINT environment variable. The request must have a Content-Type header set to either:

application/json or
application/x-www-form-urlencoded

The body of the request should contain the following parameters:

Parameter	Example Value	Description
`identity_provider`	`tokenx`	Always `tokenx`.
`target`	`<environment>:<team>:<other-app-name>`	The intended audience (target API or recipient) of the new token. Use the environment, team and application name of the target API.
`user_token`	`eyJra...`	The user's access token from the inbound request. Token that should be exchanged.

application/json application/x-www-form-urlencoded

Token request

POST ${NAIS_TOKEN_EXCHANGE_ENDPOINT} HTTP/1.1
Content-Type: application/json

{
    "identity_provider": "tokenx",
    "target": "<environment>:<team>:<other-app-name>",
    "user_token": "eyJra..."
}

Token request

POST ${NAIS_TOKEN_EXCHANGE_ENDPOINT} HTTP/1.1
Content-Type: application/x-www-form-urlencoded

identity_provider=tokenx&
target=<environment>:<team>:<other-app-name>&
user_token=eyJra...

Successful response

{
    "access_token": "eyJra...",
    "expires_in": 3599,
    "token_type": "Bearer"
}

Your application does not need to validate this token.

Consume API ¶

Once you have acquired a new token, you can finally consume the target API by using the token as a Bearer token:

http

GET /resource HTTP/1.1

Host: api.example.com
Authorization: Bearer eyJraWQ...