Authentication

import { SignJWT, importJWK } from "jose";
import { randomUUID } from "crypto";

const CLIENT_ID = "svc_a1b2c3d4e5f6";
const TOKEN_ENDPOINT = "https://abyrgverslun.is/api/oauth/token";
const jwk = JSON.parse(process.env.PRIVATE_KEY!);

async function getAccessToken(): Promise<string> {
  const privateKey = await importJWK(jwk, "ES256");

  const assertion = await new SignJWT({
    iss: CLIENT_ID,
    sub: CLIENT_ID,
    aud: TOKEN_ENDPOINT,
    jti: randomUUID(),
  })
    .setProtectedHeader({ alg: "ES256", kid: "your-key-id", typ: "JWT" })
    .setIssuedAt()
    .setExpirationTime("60s")
    .sign(privateKey);

  const res = await fetch(TOKEN_ENDPOINT, {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams({
      grant_type: "client_credentials",
      client_id: CLIENT_ID,
      client_assertion_type:
        "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
      client_assertion: assertion,
      scope: "devices:read transactions:read",
    }),
  });

  if (!res.ok) {
    const error = await res.json();
    throw new Error(`Token exchange failed: ${error.error}`);
  }

  const { access_token } = await res.json();
  return access_token;
}

// Usage
const token = await getAccessToken();
const devices = await fetch("https://abyrgverslun.is/api/v1/devices", {
  headers: { Authorization: `Bearer ${token}` },
}).then((r) => r.json());

import jwt
import jwt.algorithms
import json
import uuid
import time
import os
import requests

CLIENT_ID = "svc_a1b2c3d4e5f6"
TOKEN_ENDPOINT = "https://abyrgverslun.is/api/oauth/token"
jwk_data = json.loads(os.environ["PRIVATE_KEY"])
PRIVATE_KEY = jwt.algorithms.ECAlgorithm.from_jwk(jwk_data)


def get_access_token() -> str:
    now = int(time.time())

    assertion = jwt.encode(
        {
            "iss": CLIENT_ID,
            "sub": CLIENT_ID,
            "aud": TOKEN_ENDPOINT,
            "jti": str(uuid.uuid4()),
            "iat": now,
            "exp": now + 60,
        },
        PRIVATE_KEY,
        algorithm="ES256",
        headers={"kid": jwk_data.get("kid", "your-key-id"), "typ": "JWT"},
    )

    res = requests.post(
        TOKEN_ENDPOINT,
        data={
            "grant_type": "client_credentials",
            "client_id": CLIENT_ID,
            "client_assertion_type": "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
            "client_assertion": assertion,
            "scope": "devices:read transactions:read",
        },
    )
    res.raise_for_status()
    return res.json()["access_token"]


# Usage
token = get_access_token()
devices = requests.get(
    "https://abyrgverslun.is/api/v1/devices",
    headers={"Authorization": f"Bearer {token}"},
).json()

using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using Microsoft.IdentityModel.Tokens;

const string ClientId = "svc_a1b2c3d4e5f6";
const string TokenEndpoint = "https://abyrgverslun.is/api/oauth/token";
var jwk = new JsonWebKey(Environment.GetEnvironmentVariable("PRIVATE_KEY")!);

async Task<string> GetAccessTokenAsync()
{
    var assertion = CreateClientAssertion(jwk);

    using var http = new HttpClient();
    var res = await http.PostAsync(TokenEndpoint, new FormUrlEncodedContent(new Dictionary<string, string>
    {
        ["grant_type"] = "client_credentials",
        ["client_id"] = ClientId,
        ["client_assertion_type"] = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
        ["client_assertion"] = assertion,
        ["scope"] = "devices:read transactions:read",
    }));

    res.EnsureSuccessStatusCode();
    var json = await res.Content.ReadFromJsonAsync<JsonElement>();
    return json.GetProperty("access_token").GetString()!;
}

string CreateClientAssertion(JsonWebKey key)
{
    var credentials = new SigningCredentials(key, SecurityAlgorithms.EcdsaSha256);

    var now = DateTime.UtcNow;
    var descriptor = new SecurityTokenDescriptor
    {
        Issuer = ClientId,
        Subject = new ClaimsIdentity(new[]
        {
            new Claim("sub", ClientId),
            new Claim("jti", Guid.NewGuid().ToString()),
        }),
        Audience = TokenEndpoint,
        IssuedAt = now,
        Expires = now.AddSeconds(60),
        SigningCredentials = credentials,
        TokenType = "JWT",
    };

    var handler = new JwtSecurityTokenHandler();
    return handler.CreateEncodedJwt(descriptor);
}

// Usage
var token = await GetAccessTokenAsync();
using var http = new HttpClient();
http.DefaultRequestHeaders.Authorization =
    new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token);
var devices = await http.GetFromJsonAsync<JsonElement>(
    "https://abyrgverslun.is/api/v1/devices");