Backend: Handling Response

Register or Login your user to your Database

When the user is authenticated, you will receive a response similar to this from your front end. Your frontend is reponsible for sending this payload to your server.
1
{
2
"email": "[email protected]", // User's email (or phone number)
3
"oauth_token": {
4
"access_token": "eyJhbGciOiJFUzI1NiIsImt...", // Access Token to validate
5
"id_token": "eyJhbGciOiJFUzI1Ni...",
6
"refresh_token": "27805:CNf76faa8trMhjXM...",
7
"expires_in": 3600,
8
"token_type": "Bearer",
9
"auth_method": "OTP"
10
},
11
"user": {
12
"ID": "abcdefgh-abcd-abcd-abcd-af6f81fb5432", // Cotter User ID
13
"created_at": "2020-07-21T05:50:14.182738Z",
14
"updated_at": "2020-07-21T06:00:47.115096Z",
15
"deleted_at": "0001-01-01T00:00:00Z",
16
"issuer": "<YOUR_API_KEY_ID>",
17
"identifier": "[email protected]"
18
}
19
}
Copied!
Send this payload to your backend to register or login the user in your database. A typical flow would look like this:
  1. 1.
    Validate the access token
  2. 2.
    Check if the email exists in your database
    • If it doesn't exists: Create a new user
    • If it exists: Continue login
  3. 3.
    (Optional) If you want to use your own session tokens, set the cookie here after validating the access token.
  4. 4.
    (Optional) if you want to use Cotter's tokens, either store Cotter's access token in the cookie or on the front-end side.
Examples:
Node.js (Express)
Python (Flask)
1
const express = require("express");
2
const app = express();
3
var cors = require("cors");
4
var bodyParser = require("body-parser");
5
var cotterNode = require("cotter-node");
6
var cotterToken = require("cotter-token-js");
7
var session = require("express-session");
8
const port = 3005;
9
app.use(cors());
10
app.use(bodyParser.json());
11
​
12
​
13
// EXAMPLE LOGIN ENDPOINT
14
app.post("/login", async (req, res) => {
15
console.log(req.body);
16
​
17
// Validate access token
18
const access_token = req.body.oauth_token.access_token;
19
var valid = false;
20
try {
21
valid = await cotterNode.CotterValidateJWT(access_token);
22
} catch (e) {
23
valid = false;
24
}
25
if (!valid) {
26
res.status(403).end("Invalid access token");
27
return;
28
}
29
​
30
// (Optional) Read access token
31
let decoded = new cotterToken.CotterAccessToken(access_token);
32
console.log(decoded);
33
34
// (Optional) Register or Login User
35
​
36
// (Optional) Set access token as cookie
37
​
38
res.status(200).json(decoded.payload).end();
39
});
40
​
41
app.listen(port, () =>
42
console.log(`Example app listening at http://localhost:${port}`)
43
);
44
​
Copied!
1
from flask import Flask
2
from flask import request
3
from flask_cors import CORS
4
import requests
5
from jose import jwt
6
​
7
CotterJWKSURL="https://www.cotter.app/api/v0/token/jwks"
8
​
9
app = Flask(__name__)
10
CORS(app)
11
​
12
​
13
@app.route('/login', methods=['POST'])
14
def login(name=None):
15
req = request.get_json();
16
​
17
# Getting jwt key
18
r = requests.get(url = CotterJWKSURL);
19
data = r.json();
20
print(data);
21
public_key = data["keys"][0];
22
​
23
# Getting access token and validate it
24
token = req["oauth_token"]["access_token"]
25
resp = jwt.decode(token, public_key, algorithms='ES256', audience=API_KEY_ID)
26
27
# User Authenticated!
28
# 1) If user doesn't exist, register user to db. Otherwise, continue
29
# 2) Either use Cotter's Access Token for your entire API authorization
30
# OR
31
# You can Generate your JWT Tokens or other session management here
32
33
return resp;
Copied!

Validating Cotter's Access Token

Read more on how to verify the OAuth Tokens from Cotter here:
​
Last modified 1yr ago