1 ## Usage and Prerequisites
3 See the [REST API documentation](http://shaarli.github.io/api-documentation/)
4 for a list of available endpoints and parameters.
6 Please ensure that your server meets the
7 [requirements](Server-configuration#prerequisites) and is properly
8 [configured](Server-configuration):
10 - URL rewriting is enabled (see specific Apache and Nginx sections)
11 - the server's timezone is properly defined
12 - the server's clock is synchronized with
13 [NTP](https://en.wikipedia.org/wiki/Network_Time_Protocol)
15 The host where the API client is invoked should also be synchronized with NTP,
16 see [token expiration](#payload).
20 All requests to Shaarli's API must include a JWT token to verify their authenticity.
22 This token has to be included as an HTTP header called `Authentication: Bearer <jwt token>`.
26 - [jwt.io](https://jwt.io) (including a list of client per language).
27 - RFC : https://tools.ietf.org/html/rfc7519
28 - https://float-middle.com/json-web-tokens-jwt-vs-sessions/
29 - HackerNews thread: https://news.ycombinator.com/item?id=11929267
34 JWT tokens are composed by three parts, separated by a dot `.` and encoded in base64:
37 [header].[payload].[signature]
42 Shaarli only allow one hash algorithm, so the header will always be the same:
51 Encoded in base64, it gives:
54 ewogICAgICAgICJ0eXAiOiAiSldUIiwKICAgICAgICAiYWxnIjogIkhTNTEyIgogICAgfQ==
61 To avoid infinite token validity, JWT tokens must include their creation date
62 in UNIX timestamp format (timezone independent - UTC) under the key `iat` (issued at).
63 This token will be valid during **9 minutes**.
71 See [RFC reference](https://tools.ietf.org/html/rfc7519#section-4.1.6).
76 The signature authenticate the token validity. It contains the base64 of the header and the body, separated by a dot `.`, hashed in SHA512 with the API secret available in Shaarli administration page.
78 Signature example with PHP:
81 $content = base64_encode($header) . '.' . base64_encode($payload);
82 $signature = hash_hmac('sha512', $content, $secret);
86 ## Clients and examples
87 ### Android, Java, Kotlin
89 - [Android client example with Kotlin](https://gitlab.com/snippets/1665808)
90 by [Braincoke](https://github.com/Braincoke)
92 ### Javascript, NodeJS
94 - [shaarli-client](https://www.npmjs.com/package/shaarli-client)
95 ([source code](https://github.com/laBecasse/shaarli-client))
96 by [laBecasse](https://github.com/laBecasse)
100 This example uses the [PHP cURL](http://php.net/manual/en/book.curl.php) library.
104 $baseUrl = 'https://shaarli.mydomain.net';
105 $secret = 'thats_my_api_secret';
107 function base64url_encode($data) {
108 return rtrim(strtr(base64_encode($data), '+/', '-_'), '=');
111 function generateToken($secret) {
112 $header = base64url_encode('{
116 $payload = base64url_encode('{
119 $signature = base64url_encode(hash_hmac('sha512', $header .'.'. $payload , $secret, true));
120 return $header . '.' . $payload . '.' . $signature;
124 function getInfo($baseUrl, $secret) {
125 $token = generateToken($secret);
126 $endpoint = rtrim($baseUrl, '/') . '/api/v1/info';
129 'Content-Type: text/plain; charset=UTF-8',
130 'Authorization: Bearer ' . $token,
133 $ch = curl_init($endpoint);
134 curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
135 curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
136 curl_setopt($ch, CURLOPT_AUTOREFERER, 1);
137 curl_setopt($ch, CURLOPT_FRESH_CONNECT, 1);
139 $result = curl_exec($ch);
145 var_dump(getInfo($baseUrl, $secret));
151 See the reference API client:
153 - [Documentation](http://python-shaarli-client.readthedocs.io/en/latest/) on ReadTheDocs
154 - [python-shaarli-client](https://github.com/shaarli/python-shaarli-client) on Github
160 > This should never be used in a production environment.
162 For security reasons, authentication issues will always return an `HTTP 401` error code without any detail.
164 It is possible to enable the debug mode in `config.json.php`
165 to get the actual error message in the HTTP response body with: