Overview

Those who use the Droplit system are authenticated through their accounts, which are created through the developer portal. When a developer portal account is first created, an ecosystem and environment are created with it.

Anyone who has an account must also be registered as a user.

Droplit does not provide user credential management, and is not an identity provider. Developers must deploy their own authentication server, which must use the Droplit system for registration and authentication. This usually requires integrating or developing an identity provider. The server must register users with a key or token that uniquely identifies a user.

In the future, droplit.io will include an option to use third party identity providers for server-less products.

If a user is granted access to an environment, that user can make requests directly to that environment and its child resources.

Tokens

Tokens are used to access information in the Droplit REST API, and in the Droplit command line console. Each of these tokens can be accessed in different ways, and are used in different contexts.

Only one token should be used in an API call at a time. The documentation for each API call contains the token type required, if any, to call it successfully.

Tokens obtained from the Droplit portal will expire after a certain amount of time has elapsed. If this happens, login again. Select “Keep me logged in” to prevent the token from expiring. The following token types can be obtained from the portal:

• Account
• Server
• User

When authenticating in the console, the authentication token is stored in a Droplit folder in the home directory for a user: “USER_HOME_DIR/droplit.io/account.json”. This token does not expire.

The following token types can be obtained from the console:

• Authentication

The following token types can be created through the REST API:

• Client
• User

Account Tokens

1. Enter the Droplit portal.
2. Click on the account name in the top right corner.
3. Select “Manage Account ” from the dropdown menu.
4. Go to the “Authorization Info” section.
5. Click the “Show” button to display the account ID and account token.

Authentication Tokens

1. Login to the Droplit command line console.
2. After a correct login, the console will show the authentication token, assigned to the logged in user, for reference.
3. The token can also be accessed in the droplit.io settings folder, as described above.

Client Tokens

Use the following REST endpoint to create client tokens:
POST https://ioe.droplit.io/api/clients/:id/tokens

Server Tokens

1. Go to the Droplit portal.
2. Enter the “Server Keys” section on the left side of the screen.
3. If the ecosystem already contains one or more servers, skip to step 7.
4. Create a server by clicking the “Create a Server” button.
5. In the dialog box that appears, enter the required information to create the server.
6. Click the “Create Server” button. The server may take some time to create.
7. Select a server from the list of servers in the ecosystem.
8. Tokens are displayed under the “Tokens” section of server information.

User Tokens

1. Go to the Droplit portal.
2. Enter the “Users” section on the left side of the screen.
3. If the ecosystem already contains one or more users, skip to step 7.
4. Create a user by clicking the “Create a User” button.
5. In the dialog box that appears, enter the required information to create the user.
6. Click the “Create User” button. The user may take some time to create.
7. Select a user from the list of users in the ecosystem.
8. If the user has environment access permissions, skip to step 12.
9. Under “Access” section, click the “New access” button.
10. In the dialog box that appears, enter the ID of the environment for which the user should get full access.
11. Click the “Create Access” button to create the user access.
12. Click the “Generate Token“ button to generate the token.
13. The token is displayed in the dialog box that appears.

Credentials

Droplit supports multiple modes of authentication, which are connected to different interfaces into the system. Each mode of authentication has a unique purpose.

Developer credentials are used in the developer portal and the Droplit command line consoles.

Server credentials communicate between a client's server and the Droplit system. These credentials can be created using the developer portal. Clients have their own set of authorization tokens that can be changed over time without breaking the association to the Droplit system. Server authorization tokens are ecosystem-wide, provide unrestricted access to all ecosystem resources, and must be passed in the “authorization” header with every request. Server authorization tokens should be kept secure, and never embedded in an application where the code base could be accessed. They may be stored in a server, but storing them in a mobile application or in the client side of a web application will compromise the credentials.

User-facing applications must authenticate calls with user access tokens.