Skip to content

Commit b37ce68

Browse files
lonnieezellMGatner
andauthored
Apply suggestions from code review
Co-authored-by: MGatner <mgatner@icloud.com>
1 parent fb0f387 commit b37ce68

File tree

1 file changed

+3
-15
lines changed

1 file changed

+3
-15
lines changed

docs/guides/api-tokens.md

Lines changed: 3 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -2,18 +2,6 @@
22

33
Access Tokens can be used to authenticate users for your own site, or when allowing third-party developers to access your API. When making requests using access tokens, the token should be included in the `Authorization` header as a `Bearer` token.
44

5-
To issue tokens for users, the `UserModel` must use the `CodeIgniter\Shield\Authentication\Traits\HasAccessTokens` trait. The `UserModel` that ships with Shield already uses this trait.
6-
7-
```php
8-
use CodeIgniter\Shield\Authentication\Traits\HasAccessTokens
9-
use CodeIgniter\Model;
10-
11-
class UserModel extneds Model
12-
{
13-
use HasAccessTokens;
14-
}
15-
```
16-
175
Tokens are issued with the `generateAccessToken()` method on the user. This returns a `CodeIgniter\Shield\Entities\AccessToken` instance. Tokens are hashed using a SHA-256 algorithm before being saved to the database. The access token returned when you generate it will include a `raw_token` field that contains the plain-text, un-hashed, token. You should display this to your user at once so they have a chance to copy it somewhere safe, as this is the only time this will be available. After this request, there is no way to get the raw token.
186

197
The `generateAccessToken` method requires a name for the token. These are free strings and are often used to identify the user/device the token was generated from, like 'Johns MacBook Air'.
@@ -22,11 +10,11 @@ The `generateAccessToken` method requires a name for the token. These are free s
2210
$routes->get('/access/token', static function() {
2311
$token = auth()->user()->generateAccessToken(request()->getVar('token_name));
2412

25-
return ['token' => $token->raw_token];
13+
return json_encode(['token' => $token->raw_token]);
2614
});
2715
```
2816

29-
You can access all of the users' tokens with the `accessTokens()` method on the user.
17+
You can access all of the user's tokens with the `accessTokens()` method on that user.
3018

3119
```php
3220
$tokens = $user->accessTokens();
@@ -83,6 +71,6 @@ $routes->group('api', ['filter' => 'tokens'], function($routes) {
8371
$routes->get('users', 'UserController::list', ['filter' => 'tokens:users-read']);
8472
```
8573

86-
When the filter runs, it checks the `Authorization` header for a `Bearer` value that has the raw token. It then looks hashes the raw token and looks it up in the database. Once found, it can determine the correct user, which will then be available through an `auth()->user()` call.
74+
When the filter runs, it checks the `Authorization` header for a `Bearer` value that has the raw token. It then hashes the raw token and looks it up in the database. Once found, it can determine the correct user, which will then be available through an `auth()->user()` call.
8775

8876
Note: Currently only a single scope can be used on a route filter. If multiple scopes are passed in, only the first one is checked.

0 commit comments

Comments
 (0)