Using JSON Web Tokens

HTTP

JSON Web Tokens can only be presented via HTTP requests in the form of an Authorization header.

`Authorization` Header

For applications that communicate with Flipt over HTTP, the Authorization header is required. It must be provided in the form Authorization: JWT <jwt>. The following examples illustrate this in the context of various programming languages:

import (
  "context"
  "net/http"
)

func main() {
  req := http.NewRequest("GET", "https://flipt.your.instance/api/v1/flags", nil)
  req.Header.Set("Authorization", "JWT eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c")

  resp, err := http.Do(req)
  // ...
}

import fetch from 'node-fetch';

const headers = { 'Authorization': 'JWT eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c' }
const response = await fetch('https://flipt.your.instance/api/v1/flags', { headers: headers })

import requests

def doRequest():

  headers ={"Authorization": "JWT eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"}
  requests.get("https://flipt.your.instance/api/v1/flags", headers=headers)

  return

GRPC

For gRPC we use the Metadata functionality similar to HTTP Headers. The lower-case authorization metadata key should be supplied with a single string JWT <jwt> to any RPC calls.

Example

The following example authenticates a single gRPC client request:

rpc.go

func DoRequest(ctx context.Context, flagKey string) {
  ctx := metadata.AppendToOutgoingContext(ctx, "authorization", "JWT eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c")

  flag, err := flipt.GetFlags(ctx, &flipt.GetFlagRequest{
    Key: flagKey,
  })

  //...
}

This subsequent example demonstrates using a client unary interceptor, which authenticates all outgoing requests:

interceptor.go

func AuthUnaryClientInterceptor(optFuncs ...CallOption) grpc.UnaryClientInterceptor {
    return func(ctx context.Context, method string, req, reply interface{}, cc *grpc.ClientConn, invoker grpc.UnaryInvoker, opts ...grpc.CallOption) error {
        ctx = metadata.AppendToOutgoingContext(ctx, "authorization", "JWT eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c")
        return invoker(ctx, method, req, reply, cc, opts...)
	}
}

Overview

Use Cases

Installation

Integration

Guides

Configuration

CLI

Authentication

Authorization

Operations

Tooling

Using JSON Web Tokens

HTTP

`Authorization` Header

GRPC

Example

​HTTP

​Authorization Header

​GRPC

​Example

HTTP

`Authorization` Header

GRPC

Example