Generate a tenant token without a library

Generating tenant tokens without a library is possible, but not recommended. This guide summarizes the necessary steps.

The full process requires you to create a token header, prepare the data payload with at least one set of search rules, and then sign the token with an API key.

The token header must specify a JWT type and an encryption algorithm. Supported tenant token encryption algorithms are HS256, HS384, and HS512.

{
  "alg": "HS256",
  "typ": "JWT"
}

First, create a set of search rules:

{
  "INDEX_NAME": {
    "filter": "ATTRIBUTE = VALUE"
  }
}

Next, find your default search API key. Query the get an API key endpoint and inspect the uid field to obtain your API key's UID:

curl \
  -X GET 'http://localhost:7700/keys/API_KEY' \
  -H 'Authorization: Bearer MASTER_KEY'

For maximum security, you should also set an expiry date for your tenant tokens. The following Node.js example configures the token to expire 20 minutes after its creation:

parseInt(Date.now() / 1000) + 20 * 60

Lastly, assemble all parts of the payload in a single object:

{
  "exp": UNIX_TIMESTAMP,
  "apiKeyUid": "API_KEY_UID",
  "searchRules": {
    "INDEX_NAME": {
      "filter": "ATTRIBUTE = VALUE"
    }
  }
}

Consult the token payload reference for more information on the requirements for each payload field.

You must then encode both the header and the payload into base64, concatenate them, and generate the token by signing it using your chosen encryption algorithm.

After signing the token, you can use it to make search queries in the same way you would use an API key.

curl \
  -X POST 'http://localhost:7700/indexes/patient_medical_records/search' \
  -H 'Authorization: Bearer TENANT_TOKEN'