NABI PROTOCOL
Search
K

Authentication

Authentication is used on all our mutation operations, as well as select query operations. In the rest of the docs, operations that requires authentication will be noted.

Overview

We use JWT tokens as our authentication on our server. Our server will first generate a random nonce which needs to be signed using your TON wallet as a verification of ownership. Upon validation of your signed message, an access (and refresh) token will be issued.

Token Validity

Access tokens are valid for 30 minutes of issuance. After which, the token will be expired and any authenticated operations you perform will return HTTP 401 error. You have to use the refresh token to get another access token after 30 minutes. Refresh tokens are valid for 7 days before you have to perform this authentication process again. There is no limits on the usage of this refresh token.
There are 3 authentication resolvers:
  1. 1.
    generateNonce
  2. 2.
    getToken
  3. 3.
    refreshToken

generateNonce

This operation returns a nonce which needs to be signed using a TON Wallet. Each generated nonce is valid for 5 minutes. An unused nonce will be invalidated and a new nonce will need to be generated.

Query

GraphQL Operation
1
query GenerateNonce {
2
generateNonce {
3
id
4
nonce
5
timestamp
6
}
7
}

Response

Parameters:
  • id: Identifier for the generated nonce
  • nonce: Message to be signed
  • timestamp: Timestamp of nonce issuance
JSON Response
1
{
2
"data": {
3
"generateNonce": {
4
"id": "091741c1-5c0c-4633-a540-ee109c62a96e",
5
"nonce": "69af58a3-0c2c-49c8-a59d-34b5c74aa930",
6
"timestamp": "2023-08-17T06:25:53.925Z"
7
}
8
}
9
}

getToken

This operation takes in the signed message and id from generateNonce and returns the access token and refresh tokens if the signed message is validated.
⛔️ Access and refresh tokens are NOT shareable Tokens issued can only be used to execute mutations for Profiles that are owned by the address provided during the getToken operation. Usage by any other Profiles will return 400 error.

Query

Request inputs:
  1. 1.
    id: Identifier for the generated nonce
  2. 2.
    address: Ton Wallet address
  3. 3.
    signedMessage: Signed nonce
GraphQL Operation
1
query GetToken {
2
getToken(request: {
3
id: "091741c1-5c0c-4633-a540-ee109c62a96e",
4
signedMessage: "insert-the-signed-message"
5
}) {
6
accessToken
7
refreshToken
8
}
9
}

Response

Parameters:
  1. 1.
    accessToken
  2. 2.
    refreshToken
JSON Response
1
{
2
"data": {
3
"getToken": {
4
"accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjFjNmZiODJlLTkxYWQtNGIxYS1iYzM0LTYzYzNlYTkxZTc5ZSIsImV4cCI6MTY5MjI1NjU1NiwiaWF0IjoxNjkyMjU0NzU2fQ.PDGQfBBn89NPiqy7UiyaZ1RceZ4Q1HyaOkP1C9dgKxY",
5
"refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjFjNmZiODJlLTkxYWQtNGIxYS1iYzM0LTYzYzNlYTkxZTc5ZSIsImV4cCI6MTY5Mjg1OTU1NiwiaWF0IjoxNjkyMjU0NzU2fQ.WqiQPQaGo5rMkS2zj657IYzhzum-JFZZK9x6M1kG2lo"
6
}
7
}
8
}

refreshToken

This operation returns a new access token when provided a valid refresh token.

Query

Request inputs:
  1. 1.
    token: refresh token
GraphQL Operation
1
query RefreshToken {
2
refreshToken(request: {
3
token: "{{REFRESH_TOKEN}}"
4
}) {
5
token
6
}
7
}

Response

Parameters:
  1. 1.
    token: Newly issued access token
JSON Response
1
{
2
"data": {
3
"refreshToken": {
4
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjFjNmZiODJlLTkxYWQtNGIxYS1iYzM0LTYzYzNlYTkxZTc5ZSIsImV4cCI6MTY5MjI1NjU1NiwiaWF0IjoxNjkyMjU0NzU2fQ.PDGQfBBn89NPiqy7UiyaZ1RceZ4Q1HyaOkP1C9dgKxY"
5
}
6
}
7
}

Error Responses

🚧
WIP