Add authorization token creation endpoint to Lens Spaces API

Lens Support & Troubleshooting Feature Requests
#1

We are using cluster connect (bored agent) to support a dynamic set of edge devices. This means we need to automate the creation of cluster connect tokens. The API supports this with a valid Authorization header, but the API has no way to generate the Authorization header.

Workaround is currently to log into Lens ID and pull the Authorization header out of the browser developer console. This token only lasts 8 hours though, so we’re working to programmatically log in via a mock browser of some kind. This is obviously not ideal, and a gaping hole in the API design.

1 Like
#2

Ideally we should add support for api-key system, but in the meanwhile maybe you can try use the refresh token (not the access token you got from Authorization header)

Screenshot 2024-02-21 at 10.22.58
Screenshot 2024-02-21 at 10.22.581178×438 137 KB

to get a new access token every 8 hours, the renew token endpoint is https://app.k8slens.dev/auth/realms/lensCloud/protocol/openid-connect/token

and use the access token in Authorization header to interact with our APIs.

Full openid-config https://app.k8slens.dev/auth/realms/lensCloud/.well-known/openid-configuration

#3

Sorry I’m not following here, these statements seem at odds;
You said → “use the refresh token (not the access token you got from Authorization header)”
and then → “and use the access token in Authorization header to interact with our APIs.”

Also, if I have to programatically pull out the authorization token in order to get the refresh token, what good is the refresh token helping me with exactly?

#4

Hell, the refresh token is the token you use to renew an access token, the access token is the token you use to interact with our APIs, the one you pull from the Authorization header is the access token, which expired every 8 hr, but the refresh token does has a longer life span (don’t how long but you can decode the token and check the .exp value).

#5

It says “expires_in” is 8hours and “refresh_expires_in” 30min so… the refresh token expires quite a bit sooner? Odd.

In any case, can you send us an example of calling the token refresh API please?

#6

Answered my own question by digging in with the dev console:

  'https://keycloak.k8slens.dev/auth/realms/lensCloud/protocol/openid-connect/token' \
  -H 'accept: */*' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=refresh_token&refresh_token=REDACTED&client_id=lensCloudFrontend' | jq

The above call will return a new refresh-token and access-token.

2 Likes