Authentication

This guide describes the authentication process for accessing the GraphQL API of our e-commerce platform. It covers the basic unauthenticated access, as well as authenticated access for customers and administrators.

Overview

Our API provides different levels of access based on the user's authentication status:

• Basic Access: Available without authentication, allowing users to view product listings, categories and other general information.
• Authenticated Access: Available for users who authenticate as either a customer or an administrator, providing additional functionalities based on the user type.

Authentication Types

Unauthenticated Access

Unauthenticated users can access basic functionalities such as listing products, categories etc. These endpoints only requires an API key.

{	
  "x-api-key":"<API_KEY>",
}

Authenticated Access

Authenticated access requires users to log in using a username and password. Depending on the user type specified (ADMIN or CUSTOMER), additional functionalities are unlocked.

Login Process

To authenticate, use the login query by providing the username, password, and userType. The userType should be either ADMIN or CUSTOMER.

query loginCustomer {
  login (input: {username: "[email protected]", password: "yourpassword", userType:CUSTOMER})
  {
    AccessToken {
      token
    }
  }
}

query loginAdmin {
  login (input: {username: "[email protected]", password: "yourpassword", userType:ADMIN})
  {
    AccessToken {
      token
    }
  }
}

Upon successful authentication, the server will return a JSON Web Token (JWT).

Example:

{
  "data": {
    "login": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjdXN0b21lcl9jYXRlZ29yeSI6IsEiLCJjdXN0b21lcl90eXBlIjoxLCJleHAiOjE3MTUxNjE1ODIsInVzZXJfaWQiOiI0IiwidXNlcl9wZXJtaXNzaW9uoie1wiUHJvZHVjdFwiOmZhbHNlLFsiT3JkZXJcIjp0cnVlLFwiQ3VzdG9tZXJcIjp0cnVlfSIsInVzZXJfdHlwZSI6IkFETUlOIiwidXNlcm5hbWUiOiJUZXNQXBpSmFubmUifQ.2jfo8kHPSajF-t-2EcLo_1ct7y2pwXtVqcPHtNZrFSA"
  }
}

Using the JWT for Authenticated Requests

After obtaining the JWT, include it in the Authorization header of subsequent API requests to access authenticated functionalities.

Example of an Authenticated Request

Here is how you would include the JWT in a request to fetch customer-specific data:

Example query:

query getCustomers{
  customers(ids:[1]){
    id
    firstName
    lastName
    email
  }
}

Use appropriate tools or libraries to set HTTP headers in your client application:

{	
  "x-api-key":"<API_KEY>",
  "Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjdXN0b21lcl9jYXRlZ29yeSI6IsEiLCJjdXN0b21lcl90eXBlIjoxLCJleHAiOjE3MTUxNjE1ODIsInVzZXJfaWQiOiI0IiwidXNlcl9wZXJtaXNzaW9uoie1wiUHJvZHVjdFwiOmZhbHNlLFsiT3JkZXJcIjp0cnVlLFwiQ3VzdG9tZXJcIjp0cnVlfSIsInVzZXJfdHlwZSI6IkFETUlOIiwidXNlcm5hbWUiOiJUZXNQXBpSmFubmUifQ.2jfo8kHPSajF-t-2EcLo_1ct7y2pwXtVqcPHtNZrFSA"
}

Security Considerations

• Always use HTTPS to secure all API interactions.
• Do not expose your API key or JWT in client-side code