42 API oauth2

How does the 42 api works?

42 handles the access_token creation that you gonna be able to use to retrieves datas on any 42 users (example: his email, login, intranet level, coalition...). 42 also handles the redirection to any Url you want (it could also be: yourfavoritewebsite.com)

The goal here is to properly format the request, in order to make 42 understand it, and give us the corrects informations about the recently logged user.

What is an access_token and a refresh_token? What are they used for?

An access token is a security token that is issued to an authenticated user after they successfully log in to a system. It's a credential that is used to authenticate the user for future requests to the system. Access tokens are usually short-lived and are issued for a specific purpose and a limited period of time. When the access token expires, the user must authenticate again to obtain a new token.

On the other hand, a refresh token is a special type of token that is used to obtain a new access token after the current one has expired. Refresh tokens are typically long-lived and are issued alongside the initial access token. When the access token expires, the user can present the refresh token to the authentication server to obtain a new access token without having to re-enter their credentials.

Access tokens and refresh tokens are commonly used in web applications to authenticate users and manage their access to protected resources. They help to prevent unauthorized access to sensitive data by ensuring that only authenticated users with valid credentials can access the resources.

How to do it step by step?

1. Go to your intranet, settings, api key, and click create app.
2. Set the url of your website with the url of your frontend service app (for me http://localhost:3000)
3. Set the redirect URI to your backend api request that gonna retrieve the code, to exchange it for the user's access_token. (for me it was: http://localhost:3333/auth/42/callback).
4. Go to your backend, parse the url to get the code.

const code = req.query.code as string;

5. Exchange this code for an access token using the method POST:

const response = await fetch("https://api.intra.42.fr/oauth/token", {
	method: "POST",
	headers: { "Content-Type": "application/x-www-form-urlencoded" },
	body: `grant_type=authorization_code&client_id=${process.env.API42_CLIENT_ID}&client_secret=${process.env.API42_CLIENT_SECRET}&code=${req}&redirect_uri=${process.env.API42_REDIRECT_URI}`,
	});

6. Play with this access_token to get datas about a 42 user (all the routes are here, and simply to use: https://api.intra.42.fr/apidoc)
7. Use this token to retrieve the concerned user such as his email, his login, his profile picture...
8. Create the user in the database if it does not exist.
9. Store the access_token inside the browser cookie, to be able to access it from your frontend directly.
10. Redirect to /homepage and here you go, you have a fully working connection process!

Documentation

link to api: https://api.intra.42.fr/apidoc/guides/getting_started