Developer Docs

Method 1: Using doAuth Method(Recommended)

The customer's backend calls the /api/v1/sdk_api/v1.1/client_auth/client_access_key API to issue an access_key and passes it to the doAuth method.

const sdk = new TaggingSDK();
sdk.init({
  applicationKey: 'your-application-key',
  userKey: 'user-unique-id',
  doAuth: async (userKey) => {
    // 고객사 백엔드에서 Application Secret을 사용하여 access_key 발급
    const response = await fetch('https://your-backend.com/api/get-access-key', {
      method: 'POST',
      body: JSON.stringify({ user_key: userKey })
    });
    const data = await response.json();
    return data.access_key; // access_key 반환
  }
});

The customer's backend is implemented as follows

// 고객사 백엔드 예시
app.post('/api/get-access-key', async (req, res) => {
  const { user_key } = req.body;
  
  // Application Secret을 사용하여 tbmini API 호출
  const response = await fetch(
    `https://developers.tbmini.im/api/v1/sdk_api/v1.1/client_auth/client_access_key?user_key=${user_key}`,
    {
      method: 'POST',
      headers: {
        'X-API-Key': process.env.APPLICATION_API_KEY,
        'X-API-Secret': process.env.APPLICATION_API_SECRET
      }
    }
  );
  
  const data = await response.json();
  res.json({ access_key: data.access_key });
});

Method 2: Using authURL

The customer's backend provides an endpoint that issues an access_key, and the SDK uses that URL.

const sdk = new TaggingSDK();
sdk.init({
  applicationKey: 'your-application-key',
  userKey: 'user-unique-id',
  authURL: 'https://your-backend.com/api/get-access-key' // 고객사 백엔드 엔드포인트
});

The customer's backend should accept the user_key as a query parameter and return the access_key

// 고객사 백엔드 예시
app.post('/api/get-access-key', async (req, res) => {
  const { user_key } = req.query;
  
  // Application Secret을 사용하여 tbmini API 호출
  const response = await fetch(
    `https://developers.tbmini.im/api/v1/sdk_api/v1.1/client_auth/client_access_key?user_key=${user_key}`,
    {
      method: 'POST',
      headers: {
        'X-API-Key': process.env.APPLICATION_API_KEY,
        'X-API-Secret': process.env.APPLICATION_API_SECRET
      }
    }
  );
  
  const data = await response.json();
  res.json({ access_key: data.access_key });
});

With the issued access_key, the SDK automatically calls the /api/v1/sdk_api/v1.1/client_auth?access_key=(access_key) GET API to obtain the final token.

If set to "Secured off" on the console, the SDK directly calls the /api/v1/sdk_api/v1.1/client_auth POST API to obtain the token.
In this case, you can easily obtain tokens by putting the Application Key in the x-api-key header and the user_key in the user_key.

const sdk = new TaggingSDK();
sdk.init({
  applicationKey: 'your-application-key',
  userKey: 'user-unique-id'
  // doAuth나 authURL 설정 불필요
});

Note: Secure Off is highly recommended in production environments because of the risk of user account leakage.