DEVDOCS-6188: [update] Login with JWT #882
Conversation
There was a problem hiding this comment.
Overall I think we need to change our structure a little bit, we can use this one as a reference: https://developer.bigcommerce.com/docs/start/authentication/customer-login or even make some adjustments there: basic idea is that we use the same JWT token in loginWithCustomerLoginJwt mutation as we use in customer-login endpoint aka /login/token/{token}. It is generated by 3rd parties and everything is already described, we just need to provide some infromation about loginWithCustomerLoginJwt mutation there, that it is an alternative to HTTP endpoint 🙂
| 1. Current Customer API | ||
|
|
||
| The Current Customer API enables third-party services to securely authenticate a logged-in customer by accepting a signed JWT from BigCommerce. This allows the third party to verify the customer’s identity before granting access to sensitive information. For more details see the [Current Customer API](/docs/start/authentication/current-customer) article. |
There was a problem hiding this comment.
I'm not sure whether it is the right endpoint, we have this one for authentication purposes: https://developer.bigcommerce.com/docs/start/authentication/customer-login, the one u described here https://developer.bigcommerce.com/docs/start/authentication/current-customer is just to retrieve the customer value (has nothing to do with authentication)
|
|
||
| 2. `loginWithCustomerLoginJwt` | ||
|
|
||
| The `loginWithCustomerLoginJwt` mutation allows you to pass a customer JSON web token instead of the user's email and password. The JSON web token used can either be signed by a 3rd party or signed by BigCommerce. In this scenario, you will generate a JWT that contains key information in the payload for the login to be successful. You will use this JWT in the login mutation to receive a customer access token. For information on creating a JWT, see the [Customer Login API](/docs/start/authentication/customer-login) article for instructions. |
There was a problem hiding this comment.
The JSON web token used can either be signed by a 3rd party or signed by BigCommerce.
It is signed only by 3rd party :)
DEVDOCS-6188
What changed?
Describe the two options for logging in using a JWT
Release notes draft
Anything else?
ping {names}