Authentication with the SDK

Your system will need to authenticate with the Wallaby platform. In order to do so, you need a valid JWT from your system and Wallaby API key. In order to ensure security, your JWT should be secure with an MFA or equivalent mechanism.

API Key

API key will be provided by Wallaby team along with the RSA Key pair. You should store the API key and RSA private key as environment variables and pass them in the config when initializing the Wallaby client. Check Client Initialization for more info on the config object.

The private key will be used in generating the JWT to authorize the client when

How to generate the client JWT

• This has to be done only when the Wallaby JWT has not been retrieved yet or when it is expired.

• The JWT has to have a short expiration time (e.g., 5 minutes).

• The JWT should be signed with RS256. That way the client will have the private key and Wallaby will only have the public key.

Note: These keys should be rotated on a regular basis or when a key is compromised. This rotation has to be part of the design, although it should not be that complicated.

For generating the JWT, you need to include the following in the payload:

Using the RSA Private Key pair that is paired along with the RSA Public Key pair that Wallaby provides, create an OpenSSL RSA configuration that will be used to encode the JWT. Encode the JWT with the RSA256 algorithm using the OpenSSL RSA configuration from before, and include in the payload:

• The externalUserId param that includes the user's unique identifier in UUID format, this uuid has to be the same as the userId passed in the config object when initializing the Wallaby class.

  If the UUIDs do not match, the API will return an Unauthorized error.

• An expiration param set for a short time, (e.g 5 minutes).

Example:

  const date = new Date()
  const jwtToken = jwt.sign(
    { externalUserId,
      expiration: date.setTime(date.getTime() + (5 * 60 * 1000))
    },
    privateKey,
    { algorithm: 'RS256' },
  );