Authentication & Authorisation
SocialPay authentication relies on the MakeitSocial Single Sign On service MisAuth.
API Key
An API key is always required for any API request. An API key is associated with an app or client registered with SocialPay to keep a record of API usage by the app.
To get an API key, create an app on SocialPay's admin website.
The API key should be provided as a HTTP request header.
Example of calling the API via cURL.
curl https://socialpay.makeitsocial.com/v2/request -H "X-Api-Key:<api-key>"
Example to create a header for fetch function.
var myHeaders = new Headers();
myHeaders.append("X-Api-Key", "...");
JWT Token
A frontend app requesting access to SocialPay APIs on a user's behalf must provide a valid Javascript Web Token issued by MisAuth for this user.
To obtain a valid JWT, the app should redirect to the login page of MisAuth, and once the user signs in properly a valid JWT will be returned and used by SocialPay.
JWT can also serve for authorisation depending on the user's role on SocialPay. (see below)
Redirect to the MisAuth login page:
https://user.makeitsocial.com/login?app_id=7&theme=oval
Authorisation
A JWT specifies a user on SocialPay, and a user can have one of the following roles:
- Buyer
- Seller manager
- System admin
A buyer user will be automatically created the first time a request is made using his JWT.
A seller manager is a special role assigned by a system admin to access SocialPay API for the payment transactions associated to the seller. A seller can have multiple managers.
The system admin is a super user on the system.