Devium RMS

Product

Docs

Getting started›Authentication

Authentication

The RMS API uses OAuth2 access tokens, issued by Keycloak. You exchange a username and password for an access token (and a refresh token) at the auth endpoint, then send the access token as a Bearer token on every subsequent request.

The clients wrap this for you: login() posts the credentials, stores the returned tokens, and sets the Authorization header automatically.

Get a token

import { AuthApiClient } from '@devium/rms';

// In the browser (same origin) the default '/api/v1/auth' is fine.
// From Node or another origin, pass the full URL.
const auth = new AuthApiClient('https://app.devium.io/api/v1/auth');

const tokens = await auth.login({
  username: 'you@example.com',
  password: '••••••••',
});

console.log(tokens.accessToken, tokens.refreshToken);

from devium.rms.api.auth_api_client import AuthAPIClient

auth = AuthAPIClient(base_url="https://app.devium.io")

tokens = auth.login(username="you@example.com", password="••••••••")

print(tokens["access_token"], tokens["refresh_token"])

curl -X POST https://app.devium.io/api/v1/auth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "username=you@example.com" \
  -d "password=••••••••"
# => { "access_token": "...", "refresh_token": "...", "token_type": "bearer" }

Authenticate requests

Every other client takes the access token via setAccessToken (JS) or the access_token argument / set_access_token (Python). Over raw HTTP, send it in the Authorization header.

import { ResourceApiClient } from '@devium/rms';

const resources = new ResourceApiClient('https://app.devium.io/api/v1/resources');
resources.setAccessToken(tokens.accessToken);

const pools = await resources.getAllPools();

from devium.rms.api.resources_api_client import ResourcesAPIClient

resources = ResourcesAPIClient(
    base_url="https://app.devium.io",
    access_token=tokens["access_token"],
)

pools = resources.get_all_pools()

curl https://app.devium.io/api/v1/resources/ \
  -H "Authorization: Bearer $ACCESS_TOKEN"

Refresh an expired token

Access tokens are short-lived. Use the refresh token to obtain a new access token without re-entering credentials.

// AuthApiClient stores the refresh token from login().
const refreshed = await auth.refresh();
resources.setAccessToken(refreshed.accessToken);

refreshed = auth.refresh()
resources.set_access_token(refreshed["access_token"])
note

The JavaScript client also offers loginWithAutoRefresh() and ensureValidToken(), which transparently refresh the access token when it is close to expiry — handy for long-lived sessions.

Next steps

  • Quickstart — put this together into a first working request.