Generating and Using Authorization Tokens

Authorization tokens are currently used for the following scenarios:

• Creating passkey over authorized sessions
• Managing passkeys (listing, renaming, and deleting passkeys)

info

Authorization tokens have a very short lifespan of a few seconds, ensuring high security.

Overview Steps

1. Create an API Key in the LoginID dashboard.
2. Request an authorization token via the LoginID Grant Endpoint on your backend.
3. Use the authorization tokens.

Create Application API Key on LoginID Dashboard

First, create an API key in the LoginID developer dashboard. This key defines the permissions (scopes) for your server when interacting with LoginID APIs. In your application's Settings tab, click Add New Key to generate it.

Store your API key as a secret.

API Key Scopes

When creating an API key, you assign scopes that define the permissions available for authorization tokens. Scopes ensure your backend only performs the actions you explicitly allow.

Scope	Usage	Docs / Reference
passkey:read	List a user’s passkeys and retrieve AAGUID metadata.	Passkey Management AAGUID Metadata API
passkey:write	Rename and delete user passkeys.	Passkey Management
profile:read	Retrieve users or groups via the SCIM API.	SCIM Overview
profile:write	Create, update, or delete user profiles via the Profile API. Manage users/groups with SCIM API.	Profile API SCIM Overview
reg:write	Create secondary passkeys (any additional passkey after the first for a given user requires this scope).	Passkey Creation
auth:write	Allow authorized users to request an OTP (used in cross-authentication flows).	Cross-Auth
user:read	Use the Management Discover API.	Mgmt API
user:write	Reserved (no operations tied yet).	—
external:verify	Complete external/third-party authentication flows (e.g., after a bank login in checkout).	Checkout Flow MFA Flow

Registration Requires Authentication Token

If you plan to authorize passkey creation over authorized sessions, enable the Registration Requires Authentication Token security lock on the dashboard.

Request Authorization Token With Grant Endpoint

Use the API Key in a request to the Management grant API on your backend. You need to send this request with a Basic Authentication header.

The returning data will have the authorization token and can now be sent to the client side SDKs.

Curl

curl -X POST "{APP_BASE_URL}/fido2/v2/mgmt/grant" \
     -H "Content-Type: application/json" \
     -u $LOGINID_API_KEY: # Will set authorization header to basic.
     -d '{
           "grants": ["<SCOPE>", "<SCOPE>"],
           "username": "<USERNAME>"
         }'

• Replace {APP_BASE_URL} with your application's base URL.
• Replace <API_KEY> with your actual API key.
• Replace <SCOPE> with the appropriate scope(s) required for your token.
• Replace <USERNAME> with the username associated with the API request.

Nodejs

const LOGINID_BASE_URL = process.env.LOGINID_BASE_URL;
const LOGINID_API_KEY = process.env.LOGINID_API_KEY;

export const requestLoginIDAuthorizationToken = async (username: string) => {
  const basicToken = Buffer.from(`${LOGINID_API_KEY}:`).toString("base64");
  const res = await fetch(`${LOGINID_BASE_URL}/fido2/v2/mgmt/grant`, {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      Authorization: `Basic ${basicToken}`,
    },
    body: JSON.stringify({
      grants: ["passkey:write", "passkey:read"],
      username: username,
    }),
  });

  const data = await res.json();

  if (!res.ok) {
    throw new Error(data.message || data.msg);
  }

  return data.token;
};

Request Authorization Token With External Authentication

If your backend has already authenticated the user through an external system, you can request an authorization token using the External Auth Grant Endpoint. This flow also uses Basic Authentication with your API key.

Curl

curl -X POST "{APP_BASE_URL}/fido2/v2/mgmt/grant/external-auth" \
     -H "Content-Type: application/json" \
     -u $LOGINID_API_KEY: # Will set authorization header to basic.
     -d '{
           "username": "testUser"
         }'

Nodejs

const LOGINID_BASE_URL = process.env.LOGINID_BASE_URL;
const LOGINID_API_KEY = process.env.LOGINID_API_KEY;

export const requestExternalAuthToken = async (username: string) => {
  const basicToken = Buffer.from(`${LOGINID_API_KEY}:`).toString("base64");
  const res = await fetch(`${LOGINID_BASE_URL}/fido2/v2/mgmt/grant/external-auth`, {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      Authorization: `Basic ${basicToken}`,
    },
    body: JSON.stringify({ username }),
  });

  const data = await res.json();

  if (!res.ok) {
    throw new Error(data.message || data.msg);
  }

  return data.token;
};