• View
• Edit
• History
• Print

Authentication API

With the API key, you'll also receive a shared secret that is used to sign (on your end) and verify (on our end) requests.

Signing Requests

Let's presume that our shared secret is KILLERBRAIN. To sign a request, you need to:

1. Sort your parameters by key name, so that:

2. Construct a string with all key/value pairs concatenated together:

3. Concatenate the previous result onto your shared secret:

4. Calculate the MD5 hash of this string:

We now use this result, c6a1fd76f4642ae83e21506b3d09804c as our api_sig parameter.

User authentication for web-based applications

To authenticate users for your web-based application, construct an authentication URL as follows:

1. Take the authentication service URL:

2. Append your api_key. We'll use abc123.

3. Append a perms parameter. We'll use delete.

4. Now sign your parameters as detailed above and append an api_sig.

Voilà! An authentication URL. Point your application user at this URL, and CoboCards will:

• Ask them to login with their CoboCards credentials, if they're not already logged in, and then...
• Ask them if they wish to give your application access to their account (with the permissions you asked for).

If the user authorizes your application, they are then redirected to your callback URL with a frob parameter, like so:

If the user declines your application, they are then redirected to your cancel URL

Your application should now make a call to cc.auth.getToken with a frob parameter as passed to the callback URL. You'll get back an auth token (you use this as the auth_token parameter for all further authenticated API calls) and some user information.

Done! Simple, right?

User authentication for desktop applications

Desktop application authentication is pretty much identical to the above, but, instead of being redirected to a callback URL with a frob, we first make a call to cc.auth.getFrob and pass the result as a frob parameter in our authentication URL.

So, first of, we call cc.auth.getFrob, and it returns a <frob> element:

Then, construct an authentication URL as follows:

1. Take the authentication service URL:

2. Append your api_key. We'll use abc123.

3. Append a perms parameter. We'll use delete.

4. Append your frob from before. We'll use now 123456.

5. Now sign your parameters as detailed above and append an api_sig.

Voilà! An authentication URL for desktop applications. Point your application user at this URL, and CoboCards will:

• Ask them to login with their CoboCards credentials, if they're not already logged in, and then...
• Ask them if they wish to give your application access to their account (with the permissions you asked for).

If the user authorizes your application, they are then instructed to return to your application so that the authorization process may be completed.

Your application should now make a call to cc.auth.getToken with a frob parameter (the one you received from cc.auth.getFrob). You'll get back an auth token (you use this as the auth_token parameter for all further authenticated API calls) and some user information.

That's it!