Auth · Stellar Control

POST/v1/auth/nats

NATS credentials#

NATS credentials of follow-up

Exchanges a checked OIDC token for a NATS user JWT valid auth.nats_ttl, signed with the account signing key, for the given user nkey. It may only subscribe to stellar.run.evt.>, stellar.alarm.evt.> and _INBOX.>, and publish nothing.

Request body application/jsonrequired

public_keyrequired

string

Public nkey of the user (U…) the credentials are for.

Responses

200The JWT and its expiry.application/json

jwtrequired

string

NATS user JWT.

expiresrequired

integer · int64

Expiry (seconds since the epoch).

400Invalid body or key: api::invalid-body, auth::invalid-key.application/json

errorsrequired

array of ErrorItem

Every error found.

ErrorItem · 3 fields

coderequired

string

Stable code.

messagerequired

string

Message for the operator.

help

string

Suggested fix.

401No token, or refused: auth::jwt-required, auth::invalid-token, auth::no-provider.application/json

errorsrequired

array of ErrorItem

Every error found.

ErrorItem · 3 fields

coderequired

string

Stable code.

messagerequired

string

Message for the operator.

help

string

Suggested fix.

503No account signing key: auth::no-signing-key.application/json

errorsrequired

array of ErrorItem

Every error found.

ErrorItem · 3 fields

coderequired

string

Stable code.

messagerequired

string

Message for the operator.

help

string

Suggested fix.

Request

curl -X POST "http://localhost:8080/v1/auth/nats" \
  -H "Content-Type: application/json" \
  -d '{
  "public_key": "string"
}'

import requests

BASE_URL = "http://localhost:8080"

response = requests.post(
    f"{BASE_URL}/v1/auth/nats",
    json={
        "public_key": "string",
    },
)
response.raise_for_status()
print(response.json())

let base_url = "http://localhost:8080";

let response = reqwest::Client::new()
    .post(format!("{base_url}/v1/auth/nats"))
    .json(&serde_json::json!({
      "public_key": "string"
    }))
    .send()
    .await?
    .error_for_status()?;
let body: serde_json::Value = response.json().await?;
println!("{body:#}");

Response

{
  "jwt": "string",
  "expires": 0
}

{
  "errors": [
    {
      "code": "string",
      "message": "string",
      "help": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": "string",
      "message": "string",
      "help": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": "string",
      "message": "string",
      "help": "string"
    }
  ]
}

GET/v1/auth/config

Auth config#

How to sign in

The identity provider, the public clients of the web console and of the CLI (auth.issuer, auth.client_id, auth.cli_client_id, auth.organization), without identity: the console and stellar login ask it before signing in.

Responses

200The sign-in, if any.application/json

oidc

one of SignIn | null

Request

curl "http://localhost:8080/v1/auth/config"

import requests

BASE_URL = "http://localhost:8080"

response = requests.get(f"{BASE_URL}/v1/auth/config")
response.raise_for_status()
print(response.json())

let base_url = "http://localhost:8080";

let response = reqwest::Client::new()
    .get(format!("{base_url}/v1/auth/config"))
    .send()
    .await?
    .error_for_status()?;
let body: serde_json::Value = response.json().await?;
println!("{body:#}");

Response

{
  "oidc": {
    "issuer": "string",
    "client_id": "string",
    "cli_client_id": "string",
    "organization": "string",
    "scopes": [
      "string"
    ]
  }
}