Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
@commercelayer/js-auth
Advanced tools
A JavaScript Library wrapper that helps you use the Commerce Layer API for Authentication.
Commerce Layer is a multi-market commerce API and order management system that lets you add global shopping capabilities to any website, mobile app, chatbot, wearable, voice, or IoT device, with ease. Compose your stack with the best-of-breed tools you already mastered and love. Make any experience shoppable, anywhere, through a blazing-fast, enterprise-grade, and secure API.
To get started with Commerce Layer JS Auth, you need to install it and add it to your project.
Commerce Layer JS Auth is available as an npm package.
# npm
npm install @commercelayer/js-auth
# yarn
yarn add @commercelayer/js-auth
# pnpm
pnpm add @commercelayer/js-auth
To get an access token, you need to execute an OAuth 2.0 authorization flow by using a valid application as the client.
Grant type | Sales channel | Integration | Webapp |
---|---|---|---|
Client credentials | ✅ | ✅ | |
Password | ✅ | ||
Refresh token | ✅ | ✅ | |
Authorization code | ✅ |
Remember that, for security reasons, access tokens expire after 2 hours. Authorization codes expire after 10 minutes.
Check our documentation for further information on each single authorization flow.
Based on the authorization flow and application you want to use, you can get your access token in a few simple steps. These are the most common use cases:
Sales channel applications use the client credentials grant type to get a "guest" access token.
Create a sales channel application on Commerce Layer and take note of your API credentials (base endpoint, client ID, and the ID of the market you want to put in scope)
Use this code to get your access token:
import { core } from '@commercelayer/js-auth'
const token = await core.authentication('client_credentials', {
clientId: 'your-client-id',
slug: 'your-organization-slug',
scope: 'market:{id}'
})
console.log('My access token: ', token.accessToken)
console.log('Expiration date: ', token.expires)
Sales channel applications can use the password grant type to exchange a customer credentials for an access token (i.e., to get a "logged" access token).
Create a sales channel application on Commerce Layer and take note of your API credentials (base endpoint, client ID, and the ID of the market you want to put in scope)
Use this code (changing user name and password with the customer credentials) to get the access token:
import { core } from '@commercelayer/js-auth'
const token = await core.authentication('password', {
clientId: 'your-client-id',
slug: 'your-organization-slug',
scope: 'market:{id}',
username: 'john@example.com',
password: 'secret'
})
console.log('My access token: ', token.accessToken)
console.log('Expiration date: ', token.expires)
console.log('My refresh token: ', token.refreshToken)
Sales channel applications can use the refresh token grant type to refresh a customer access token with a "remember me" option:
import { core } from '@commercelayer/js-auth'
const newToken = await core.authentication('refresh_token', {
clientId: 'your-client-id',
slug: 'your-organization-slug',
scope: 'market:{id}',
refreshToken: 'your-refresh-token'
})
Integration applications use the client credentials grant type to get an access token for themselves.
Create an integration application on Commerce Layer and take note of your API credentials (client ID, client secret, and base endpoint)
Use this codes to get the access token:
import { core } from '@commercelayer/js-auth'
const token = await core.authentication('client_credentials', {
clientId: 'your-client-id',
clientSecret: 'your-client-secret',
slug: 'your-organization-slug',
})
console.log('My access token: ', token.accessToken)
console.log('Expiration date: ', token.expires)
Available only for browser applications
Webapp applications use the authorization code grant type to exchange an authorization code for an access token.
In this case, first, you need to get an authorization code, then you can exchange it with an access token:
Create a webapp application on Commerce Layer and take note of your API credentials (client ID, client secret, callback URL, base endpoint, and the ID of the market you want to put in scope)
Use this code to authorize your webapp on Commerce Layer:
curl -g -X GET \
'https://dashboard.commercelayer.io/oauth/authorize?client_id=your-client-id&redirect_uri=https://yourdomain.com/redirect&scope=market:1234&response_type=code' \
-H 'Accept: application/json' \
-H 'Content-Type: application/json'
or copy and paste this URL in your browser:
https://dashboard.commercelayer.io/oauth/authorize?client_id=your-client-id&redirect_uri=https://yourdomain.com/redirect&scope=market:1234&response_type=code
Once you've authorized the application, you will be redirected to the callback URL:
Use this code to get the access token:
import { core } from '@commercelayer/js-auth'
const token = await core.authentication('authorization_code', {
clientId: 'your-client-id',
clientSecret: 'your-client-secret',
callbackUrl: '<https://yourdomain.com/callback>',
slug: 'your-organization-slug',
scope: 'market:{id}',
code: 'your-auth-code'
})
console.log('My access token: ', token.accessToken)
console.log('Expiration date: ', token.expires)
Provisioning applications use a specific authentication function which implicitly uses the client credentials grant type to get an access token.
Access your personal provisioning application on Commerce Layer dashboard and take note of your Provisioning API credentials (client ID, client secret)
Use this codes to get the access token:
import { provisioning } from '@commercelayer/js-auth'
const token = await provisioning.authentication({
clientId: 'your-client-id',
clientSecret: 'your-client-secret'
})
console.log('My access token: ', token.accessToken)
console.log('Expiration date: ', token.expires)
Fork this repository (learn how to do this here).
Clone the forked repository like so:
git clone https://github.com/<your username>/commercelayer-js-auth.git && cd commercelayer-js-auth
Make your changes and create a pull request (learn how to do this).
Someone will attend to your pull request and provide some feedback.
Request an invite to join Commerce Layer's Slack community.
Create an issue in this repository.
Ping us on Twitter.
This repository is published under the MIT license.
FAQs
A JavaScript library designed to simplify authentication when interacting with the Commerce Layer API.
The npm package @commercelayer/js-auth receives a total of 2,136 weekly downloads. As such, @commercelayer/js-auth popularity was classified as popular.
We found that @commercelayer/js-auth demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.