Documentation for the Web Transceiver authentication API (/api/v2/auth-wt-legacy)?

Special Forums Third-Party Apps
1

Hi folks, I'm playing around with my own open-source IAX2 client for iOS and macOS and I am curious about how Web Transceiver authentication token is expected to be used and how long the token is supposed to last.

I noticed that the /api/v2/auth-wt-legacy endpoint was [listed as requiring documentation ( Fully Document /api/v2/auth-wt-legacy · Issue #229 · AllStarLink/ASL3-Manual · GitHub ) and so I've dropped in my observations there of how it's supposed to be working (if I understood it correctly from my experiments).

I gather that Web Transceiver doesn't seem to be clearly supported/documented, but that lots of apps are effectively using it anyway, and that it's possibly planned to be retired ("legacy").

Is it ok for external apps to be using it?

Is it a one-token-forever situation or do they have an expected lifetime?

Is there any information you could share about what might come next?

Thanks!

-VK1CPM

2

"WebTransceiver" is being replaced by a new login API but that isn't ready even for beta testing yet. Here's how /api/v2/auth-wt-legacy.php works:

 * /api/v2/auth-wt-legacy.php is the API for checking credentials
 * for a "Web Transceiver" login. It returns a JSON payload
 *
 * POST payload:
 * {
 *     'username' : 'ACCT_USERNAME' ,
 *     'password' : 'ACCT_PASSWORD',
 *     'cookie' : 'COOKIE'            <---- THIS IS OPTIONAL
 * }
 *
 * Return:
 *
 *     {
 *          'status' : "OK" | "ERR"
 *          'auth' : 1|0 ,          <---- 1 = Success, 0 = Failure
 *          'token' : 'TOKEN'       <---- The authentication token
 *          'cookie' : 'COOKIE'     <---- IF PROVIDED IN THE PAYLOAD
 *          'msg' : 'MESSAGE'       <--- If status = Error, has the error, otherwise not present
 *     }
 *
 *
 * Other HTTP methods will return HTTP 405.
3

Thanks so much @N8EI ! This is really helpful.

Is the expectation that one token is generated per new connection to a node or is a token supposed to be used for a while for multiple connections?

Really helpful to know that the successor API is still at an early stage, I guess the practical consequence is that WT is still the necessary for the moment and worth getting right in the near term.

4

Currently, the token only changes when the user changes their password. However the new API will change more frequently. I would suggest that you perform a login on every app open or node connection from the start to be prepared for the change.

5

Super helpful info, thanks @N8EI !