Nagging Penguin Matriarchs

    TypeScript icon, indicating that this package has built-in type declarations

    0.3.2 • Public • Published


    Authentication protocol library implementation in TypeScript

    Credentials generation

    The only supported credential type for the time being, are the 'third-party' credentials.

    Third Party credentials

    This type of credential require the intervention of a third party (authentication server) in order to authenticate the user against a service provider

     const timeToLive = 10 // In seconds
     const k = SimpleCredential.generateNewKey(timeToLive)

    Request credentials generation

    const messageToSend = MessageInput.fromMessage(messageContent) // messageContent is a buffer
    const timeToLive = 10 // In seconds
    const k = SimpleCredential.generateNewKey(timeToLive)
    const messageCredentials = k.makeMessageCredentials(messageToSend, accessToken) // Access Token given by the third party. To generate one you will need to send the ecdsa public key generated as part of the credential generation process
    // If the message is an http request
    const method = 'POST'
    const url = ''
    const body = Buffer.from(
        JSON.stringify({ param1: 'data1', param2: 'data2' }),
    const httpMessage = MessageInput.fromHttpRequest(method, url, body)
    const messageCredentials = k.makeMessageCredentials(httpMessage, accessToken) // Access Token given by the third 
    messageCredentials.set('Content-Type', 'application/json') //And the rest of your headers
    const response = await fetch(path, {
        method: 'post',
        headers: headers,
    Generated Credentials
    Header Meaning
    x-signature This is the signed request information (http method + url + body + timestamp) with the generated ephemeral key. This is vital to prevent replay attacks.
    x-timestamp Request timestamp, in Unix time.
    x-auth-type Indicates the type of credential, in this case “third-party”
    x-identity The users ephemeral public key used in the access token creation and the user ID
    x-access-token Access token. Contains the public ephemeral key and it is signed by the granting authority with its own private key.

    Request validation

    The service providers will need to authenticate the users based on the information present in the request headers.

    Authentication Strategies

    We define three basic Authentication strategies

    Third party strategy

    The service provider will need to know the entity who signs the access token, otherwise, the request will be rejected.

    const timeToLive = 10 // In seconds
    const authServicePubKey = ... // Pem encoded public key of the trusted auth service
    const authn = AuthenticationFactory.createThirdPartyStrategy(timeToLive, authServicePubKey})
    const authProvider = new AuthProvider(authn, new AuthorizeAllStrategy())
    const req: AuthRequest = ...
    const result: Result = authProvider.validateRequest(req)

    Allow All

    const authn = new AuthenticateAllStrategy()
    const authz = new AuthorizeAllStrategy()

    Copyright info

    This repository is protected with a standard Apache 2 licence. See the terms and conditions in the LICENSE file.



    npm i decentraland-auth-protocol

    DownloadsWeekly Downloads






    Unpacked Size

    44 kB

    Total Files


    Last publish


    • cazala