How to authenticate with the API on the command line?

Cookies

To authenticate with an HTTP cookie, you will first need to login with a username and password. This will create an HTTP Cookie that is sent back to your browser.

Because browsers send HTTP Cookies with every request to the domain they came from, a lot of attention needs to be dedicated to prevent Cross Site Request Forgery (CSRF). DjaoDjin is using CSRF tokens as a mitigation solution. You will thus need to GET the login page, retrieve the CSRF tokens, and POST to the page, setting the appropriate headers.

On the command line, it looks like:

$ curl -v https://mysite.djaoapp.com/login/ | grep csrfmiddlewaretoken
...
< Set-Cookie: csrftoken=csrftoken_value;  expires= ...
...
<input type="hidden" name="csrfmiddlewaretoken" value="csrfmiddlewaretoken_value">
...

Note csrftoken_value and csrfmiddlewaretoken_value, you will need them for the POST phase as such:

$ curl -v -H 'Referer: https://mysite.djaoapp.com/login/' --cookie "csrftoken=csrftoken_value" -d "csrfmiddlewaretoken=csrfmiddlewaretoken_value&username=my_username&password=my_password" https://mysite.djaoapp.com/login/
...
< Set-Cookie: sessionid=sessionid-value; expires=...

Armed with a sessionid-value, we can now authenticate with the API.

To validate the sessionid works, we are going to fetch the user profile of the authenticated user. On the command line, this looks like:

$ curl -v --cookie "sessionid=sessionid-value" https://mysite.djaoapp.com/api/users/my_username/

JSON Web Tokens

To authenticate with a JSON Web Token, you will first need to create a token by calling /api/auth/ with a username and password. The call will return a token you can subsequently use to authenticate with the service.

On the command line, it looks like:

$ curl -X POST -H 'Accept: application/json' -H 'Content-Type: application/json' -d '{"username":"my_username","password":"my_password"}' https://mysite.djaoapp.com/api/auth/
{"token":"token-value"}
        

Note token-value. We can now use it to fetch the user profile of the authenticated user. On the command line, this looks like:

$ curl -H 'Accept: application/json' -H 'Authorization: Bearer token-value' https://mysite.djaoapp.com/api/users/my_username/
        

API Keys

To authenticate with an API Key, you will need to create an API key at least once. API Keys are valid until they are revoked. Of course you will need to authenticate with the service first in order to create or rotate a user's API Key (either through a Cookie or a JSON Web Tokens).

For additional security, you will need to pass the password of the authenticated user in order to successfully create or rotate an API Key.

First we are going to create a JSON Web Token (JWT) as above.

$ curl -X POST -H 'Accept: application/json' -H 'Content-Type: application/json' -d '{"username":"my_username","password":"my_password"}' https://mysite.djaoapp.com/api/auth/
{"token":"token-value"}
        

Armed with a JWT we can now create an API Key for the authenticated user. On the command line, this looks like:

$ curl -X POST -H 'Authorization: Bearer token-value' -H 'Accept: application/json' -H 'Content-Type: application/json' -d '{"password":"my_password"}' https://mysite.djaoapp.com/api/auth/
{"secret":"secret-value"}

Once we have an API Key, we can start using it directly to authenticate with the service.

To validate the API secret key works, we are going to fetch the user profile of the authenticated user. On the command line, this looks like:

$ curl -u secret-value: https://mysite.djaoapp.com/api/users/my_username/
            

Note the : character after the secret-value.