Authentication

Authenticating with the Cirro API is done using signed JSON Web Tokens (JWT). You can generate a JWT using your app's private key as well as your apps ID.

Generate a RSA key pair

Generate a RSA key pair for your app at your app's settings page. Once generated the private key in "PEM" format will be downloaded automatically. Please store the key file securely on your app's server. Each key pair comes with a unique fingerprint. You can verify your key's fingerprint with:

openssl rsa -in PATH_TO_PEM_FILE -pubout -outform DER | openssl sha1 -c

Create your access token

To authenticate to cirro API you need the following:

• The private key in PEM format
• Your app ID

Use your private key to sign a JSON Web Token (JWT) which contains your app's id as the issuer in the payload.

1# Example in ruby
2
3require 'openssl'
4require 'jwt'
5
6# Private key contents
7private_pem = File.read(PATH_TO_YOUR_PEM_FILE)
8private_key = OpenSSL::PKey::RSA.new(private_pem)
9
10payload = {
11  # JWT expiration time (10 minute maximum)
12  exp: Time.now.to_i + (10 * 60),
13  # App client id
14  sub: YOUR_APP_ID
15}
16
17jwt_token = JWT.encode(payload, private_key, 'RS256')