How to authenticate incoming requests from Consent Manager?

[Arvind]

Can we use Authorization header in APIs like /v0.5/care-contexts/discover API to authenticate Consent Manager?
If yes, how can we do that?

[Mounica]

Hi @Arvind,

Any calls that a HIP/HIU receive will be communicated from CM via Gateway. You can use Authorization header to authenticate the incoming requests from Gateway.
It contains the gateway role which you can use to authorize the requests.

Thanks.

[Arvind]

Hey @Mounica,

Thanks for your reply.
As a follow-up question,
Does this authorization header matches with the Access token that we receive in Sessions API, so that we can match it with to authenticate requests?

[Gayatrij]

Hi @Arvind,
Its not the same access token that you receive in sessions API. It contains the gateway role which you can use to authorise the requests.

[raveeo]

Hi @Gayatrij

Can you please elaborate on how to validate the gateway request? Unable to understand the usage of gateway role in doing the same.

Regards,
Ravi

[mdubey]

Hi @raveeo,

Please have a look at another thread where we discussed similar. Let us know if you have more questions.

Best Practice to validate Authorization token

We have api endpoints to generate session token using “/v0.5/sessions”. What is best practice to make sure that token is valid for the current duration? Should we keep track of it using expiresIn property that we get or should be generate token each time we need access token (not a best practice i think) or is there any API through which we can validate the token?

Thank you

[raveeo]

Thank you… will check it out