Security
The menu dedicated to security asset management such as API Key, Server Key.
Last updated
Was this helpful?
The menu dedicated to security asset management such as API Key, Server Key.
Last updated
Was this helpful?
With secure mode off, Social Plus SDK generates an access token on the client side when given an userId and apiKey. This can lead to malicious users abusing the endpoint and spying on someone else's session.
With secure mode on, an additional authentication token generated from your own backend server using a separate Server Key is required. You must turn on secure mode in your production system, or the system will be vulnerable to such an attack.
Social Plus provides a way to get the server key easily via the SP Console as follows:
Login to your SP Console
Go to Settings -> Integrations
Enable secure mode via the toggle.
4. Click "Generate new server key" to generate your server key
5. A warning message will pop up. Please ensure to read it and be aware of the impact.
6. The server key will be shown, please copy and securely store it in your backend system. The key will only be shown once.
Once secure mode is enabled and the server key is generated, all client authentication requests will require an authentication token. Your backend server will need to make a server-to-server call while passing the server key into the Social Plus server to get the authentication token. Please follow the following steps to generate an auth token:
Client initiates a call to the backend.
Europe
eu
https://apix.eu.amity.co/
Singapore
sg
https://apix.sg.amity.co/ or https://apix.amity.co/
United States
us
https://apix.us.amity.co/
Receive the auth token back and find a way to pass it up from the server side to the client-side and give it to the SDK.
To use auth token on the client side, please see the Getting Started guide.
An API key will be provided when you create the application.
Open Social Plus Console.
On the left menu, select Settings to expand its submenu.
Select Integrations.
On the Integrations page, you will find the apiKey.
There are 2 modes of Authentication:
Unsecure mode
Secure mode
With secure mode disabled, you can connect directly to the Social Plus server.
2. In the Responses, you will find that the server will return an access token in the Response body.
With secure mode enabled, it provides an additional layer of security because it requires server-level authentication.
2. The server will return an authentication token in the Response body.
4. In the Responses section, you will find that the server will return an access token in the Response body.
Mutual Transport Layer Security or mTLS, is a two-way mutual authentication technique. It helps two parties to authenticate at both ends of a network if they have the correct private key. mTLS ensures that the people at both ends of a network connection are who they claim to be.
In the Console, go to Settings > Security tab
Click +Create Certificate option to create the certificate
Specify the Certificate Name and Certificate Signing Request (CSR)
Activate the mTLS feature
Enabling the mTLS feature is optional.
Client's servers make a request to endpoint on SDK API server, with server key and userId. Refer to the table below for the correct region code and endpoint.
1. Call using the API key and user id. Refer to section for the instructions on how to get the API key.
If Secure mode is enabled, you will need the server key. Refer to our documentation on from the console.
1. Call using the server key.
3. Call using the returned token.
Access token is different from the authentication token returned when calling .
and will be protected by mTLS and provide an extra layer of security.
