Extract Auth ID from an input parameter

Mike Akister

I have a public endpoint that needs to return some initial data, however, if the User is Auth'd (required to make make the booking) it needs to return the initial data with the additional data from the booking specific to the Auth ID.

I would like to pass the Auth token via an input and extract the Auth details within a certain part of the function stack. But it seems that the only way to extract Auth ID is to enable Authentication for the entire endpoint. Is there anyway to extract the Auth ID from the authentication token within a function if it is passed as an input rather than in the header?

Ray Deck

Hey Mike! We did this in a State Change Pro office hours. The token itself is encrypted and only decrypted in the context of the authorization header preprocessor. Our solution was we had endpoint A receive the token as an input, and then called a second, internal-only endpoint, B, using that token in the Authorization header. The second endpoint had access to the contents (id and claims, if any).

Mike Akister

Thank you @Ray Deck for the suggestion! This is working flawless now! I send two parameters to the unauthenticated endpoint, the leg_id and the auth token. I retrieve all the details that I need about the leg that are not behind authentication, and just set those that may have data from behind authentication to default values.

Then I make the internal API request and pass the auth token in the header of that request and retrieve all the data behind authentication. I then update the results containing default values with the appropriate data from behind authentication. This is such a slick way to implement this, thanks again for the answer!

Just a snapshot of the default values that then get updated with data

Default values that are displayed regardless of authentication:

Values that are then overwritten if data exists behind authentication

I now only need one endpoint to populate this screen, which saved me building a screen for auth'd users and one for non- auth'd users.

Adam Che

@Ray Deck and @Mike Akister
Thanks for this, this is exactly what i was looking for.

I tried this but im getting 403 error.

When I call the private xano endpoint from within a public xano endpoint this is how I set up the auth header:

I tried both encoded and not.

The original call is coming from weweb, where I include the auth token in the "parent" public endpoint as

Authorization: Bearer eyJ………


What am I missing or doing wrong?

Thanks in advance

Ray Deck

The key is not a base64 encoded version of the id. The key will be in the headers. You can get the env variable $http_headers and get the path Authorization to get "Bearer eyxeriojdfnernlkjsd…". That's what you then add to your Authorization: prefix for the secondary call.