Connect

STF API - Security requirements and authentication

ClientId and secret

The STF API series utilises a clientid and secret challenge and provides a limited life bearer token as the authentication mechanism for all activities and on all routes within the API universe.

The technology utilises JSON Web Tokens as the security passport and is implemented as a standard POST method with the clientid and secret in the body of the message and responds with the token.

If you have not yet acquired a clientId and secret, please contact FMCGX

JWT Bearer token

JSON Web Tokens are an open, industry standard* method for representing claims securely between two parties. This provides for signed, encrypted claims and sets the trust between the parties.

*(RFC 7519 )

Authentication method

Base URL

Once a clientID and secret have been obtained from the FMCGX support team, it can be utilised in the method described below to connect to the api to obtain the bearer token that will validate and provide authenticated access.

UAT testing end-point:
Base url: stf-api-uat.data-xchange.co.za/api/
Endpoint: authentication/token

POST /authentication/token

Parameter	Value	Description	Parameter Type	Data Type
Accept	application/json	Accept Header	Header	string
Content-Type	application/json	Content Type	Header	string

Body:

{
  "clientId": "[assigned clientID]",
  "clientSecret": "[assigned secret]",
  "scope": "stf-api"
}

Returns:

{
  "accessToken": "string",
  "scope": "string",
  "tokenType": "string",
  "expiresIn": 0,
  "httpStatusCode": 0,
  "httpErrorReason": "string",
  "error": "string"
}

A javascript example for use in Node.js using the Fetch(http) library

async function getAuthToken() {
  try {
    let response = await fetch(
      "https://stf-api-uat.data-xchange.co.za/api/authentication/token",
      {
        method: "POST",
        headers: {
          "Content-Type": "application/json",
          Accept: "application/json",
        },
        body: JSON.stringify({
          clientId: "clientId",
          clientSecret: "clientSecret",
          scope: "stf-api",
        }),
      }
    );
    let data = await response.json();
    return data;
  } catch (err) {
    console.log(err);
  }
}

Get started instantly

A service stack client coupled with an STF nuget package will get you started immediately. Follow the tutorial to get you started and auto-generate all of the client source code and the Data Transfer Objectrs (DTOs) that you will need to interact with the STF API message models. More information on Service Stack. If you prefer to create your own native code, you can access the dto's directly