Auth0 Fine-Grained Authorization

https://docs.fga.dev/
Admin
Auth0 Fine-Grained Authorization enables developers to design centralized, flexible, fast, scalable,...
Tokens:449,847
Snippets:2,146
Trust Score:8.4
Update:1 year ago
Show doc for...
Tokens:
Raw
### Untitled

No description

--------------------------------

### Untitled

No description

--------------------------------

### Install Go SDK and initialize client

Source: https://docs.fga.dev/integration/install-sdk

Installs the Auth0 FGA SDK for Go using 'go get' and demonstrates basic client initialization within a Go program. This requires Go to be installed and configured.

```shell
go get -u github.com/openfga/go-sdk  

```

```go
import (
    . "github.com/openfga/go-sdk/client"
)

func main() {
    fgaClient, err := NewSdkClient(&ClientConfiguration{
        // ... setup the sdk
    })

    if err != nil {
        // .. Handle error
    }
}

```

```shell
go mod tidy  

```

--------------------------------

### Untitled

No description

--------------------------------

### Untitled

No description

--------------------------------

### Configure FGA API Environment Variables

Source: https://docs.fga.dev/getting-started

Sets up essential environment variables for interacting with the FGA API. These variables include API URLs, token issuer, audience, and client credentials. Ensure these are replaced with your actual credentials.

```bash
FGA_API_URL='https://api.us1.fga.dev'
FGA_API_TOKEN_ISSUER="auth.fga.dev"
FGA_API_AUDIENCE='https://api.us1.fga.dev/'

# Change these variables   
FGA_STORE_ID='YOUR_STORE_ID'
FGA_CLIENT_ID='YOUR_CLIENT_ID'
FGA_CLIENT_SECRET='YOUR_CLIENT_SECRET'
```

--------------------------------

### Untitled

No description

--------------------------------

### Untitled

No description

--------------------------------

### Untitled

No description

--------------------------------

### Create API Client Credentials

Source: https://docs.fga.dev/getting-started

Instructions on how to create API client credentials, which are necessary for authenticating and making API calls. This involves navigating to Settings, creating a new client, selecting permissions, and storing the provided credentials.

```APIDOC
## Create API Client Credentials

### Description
Guides users through the process of generating API client credentials required for authenticating with the FGA API.

### Steps
1. Navigate to **Settings** in the Dashboard.
2. Click **Create Client** if no client secret exists.
3. Enter a client name.
4. Select required permission sets.
5. Click **Create**.
6. Store the **Store ID**, **Client ID**, and **Client Secret**. The client secret will not be visible again after this step.
```

--------------------------------

### Untitled

No description

--------------------------------

### Untitled

No description

--------------------------------

### Untitled

No description

--------------------------------

### Untitled

No description

--------------------------------

### Untitled

No description

--------------------------------

### Untitled

No description

--------------------------------

### Untitled

No description

--------------------------------

### Verify User Cannot Share Permission with cURL

Source: https://docs.fga.dev/getting-started

This cURL command checks if a user has the 'can_share' relation to a specific document. This example verifies that a user without explicit sharing permissions cannot perform the action.

```bash
curl --request POST \
  --url $FGA_API_URL/stores/$FGA_STORE_ID/check \
  --header "authorization: Bearer $FGA_API_TOKEN" \
  --header 'content-type: application/json' \
  --data '{ \
    "tuple_key": \
      { \
        "user": "user:anne", \
        "relation": "can_share", \
        "object": "document:1" \
      } \
  }'
```

--------------------------------

### Untitled

No description

--------------------------------

### Untitled

No description

--------------------------------

### Untitled

No description

--------------------------------

### Untitled

No description

--------------------------------

### Untitled

No description

--------------------------------

### Authenticate API Request

Source: https://docs.fga.dev/getting-started

Demonstrates how to obtain an access token using client ID and client secret via a POST request to the FGA token issuer endpoint. It includes a `curl` example and explains how to save the obtained token for subsequent API calls.

```APIDOC
## Authenticate API Request

### Description
Explains how to obtain an access token using OAuth 2.0 with your client credentials. This token is then used to authorize subsequent API requests.

### Method
POST

### Endpoint
`https://<FGA_API_TOKEN_ISSUER>/oauth/token`

### Parameters
#### Request Body
- **client_id** (string) - Required - Your client ID.
- **client_secret** (string) - Required - Your client secret.
- **audience** (string) - Required - The API audience URL.
- **grant_type** (string) - Required - Must be `client_credentials`.

### Request Example
```bash
curl --request POST \
  --url https://$FGA_API_TOKEN_ISSUER/oauth/token \
  --header 'content-type: application/json' \
  --data '{ \
    "client_id": "'$FGA_CLIENT_ID'", \
    "client_secret": "'$FGA_CLIENT_SECRET'", \
    "audience": "'$FGA_API_AUDIENCE'", \
    "grant_type": "client_credentials" \
  }'
```

### Response Example (Success - 200 OK)
```json
{
  "access_token": "eyJhbGciOiJSUzI1NiIs.Ino4TzF1WEp.UMkZ5UHRqZ3RmZDZoMiJ9",
  "scope": "check:tuples expand:tuples list:objects list:users read:assertions read:authorization_models read:changes read:tuples write:assertions write:authorization_models write:tuples",
  "expires_in": 86400,
  "token_type": "Bearer"
}
```

### Storing the Access Token
```bash
FGA_API_TOKEN="YOUR_ACCESS_TOKEN"
```
*Replace `YOUR_ACCESS_TOKEN` with the `access_token` from the response.
```

--------------------------------

### Configure OpenFGA Client in Go

Source: https://docs.fga.dev/integration/setup-sdk-client

This Go code demonstrates initializing the OpenFGA SDK client. It reads configuration values such as API URL, store ID, and authentication details from environment variables, using the client credentials method for authentication.

```go
import (
    "os"
    . "github.com/openfga/go-sdk/client"
    "github.com/openfga/go-sdk/credentials"
)

func main() {
    fgaClient, err := NewSdkClient(&ClientConfiguration{
        ApiUrl:               os.Getenv("FGA_API_URL"),
        StoreId:              os.Getenv("FGA_STORE_ID"),
        AuthorizationModelId: os.Getenv("FGA_MODEL_ID"),
        Credentials: &credentials.Credentials{
            Method: credentials.CredentialsMethodClientCredentials,
            Config: &credentials.Config{
                ClientCredentialsClientId:       os.Getenv("FGA_CLIENT_ID"),
                ClientCredentialsClientSecret:   os.Getenv("FGA_CLIENT_SECRET"),
                ClientCredentialsApiAudience:    os.Getenv("FGA_API_AUDIENCE"),
                ClientCredentialsApiTokenIssuer: os.Getenv("FGA_API_TOKEN_ISSUER"),
            },
        },
    })

    if err != nil {
        // .. Handle error
    }
}
```

--------------------------------

### Untitled

No description

--------------------------------

### Untitled

No description

--------------------------------

### Initialize OpenFGA Client in Go

Source: https://docs.fga.dev/modeling/token-claims-contextual-tuples

Provides the setup for initializing the OpenFGA client SDK in a Go application. It imports necessary packages and expects environment variables to be configured for connection parameters.

```go
// Checkout the "How to Setup the SDK Client" page for more details.
import (
    "os"

    openfga "github.com/openfga/go-sdk"
    . "github.com/openfga/go-sdk/client"
    "github.com/openfga/go-sdk/credentials"
)

// Ensure the environment variables are set
```

--------------------------------

### Untitled

No description

--------------------------------

### Initialize OpenFGA SDK Client in C#

Source: https://docs.fga.dev/modeling/token-claims-contextual-tuples

Provides an example of initializing the OpenFGA SDK client in C# using environment variables. It configures API URL, Store ID, Model ID, and client credentials. The code demonstrates setting up the client configuration and instantiating the `OpenFgaClient`.

```csharp
var configuration = new ClientConfiguration() {
    ApiUrl = Environment.GetEnvironmentVariable("FGA_API_URL"),
    StoreId = Environment.GetEnvironmentVariable("FGA_STORE_ID"),
    AuthorizationModelId = Environment.GetEnvironmentVariable("FGA_MODEL_ID"),
    Credentials = new Credentials() { // Credentials are not needed if connecting to the Playground API
        Method = CredentialsMethod.ClientCredentials,
        Config = new CredentialsConfig() {
            ApiTokenIssuer = Environment.GetEnvironmentVariable("FGA_API_TOKEN_ISSUER"),
            ApiAudience = Environment.GetEnvironmentVariable("FGA_API_AUDIENCE"),
            ClientId = Environment.GetEnvironmentVariable("FGA_CLIENT_ID"),
            ClientSecret = Environment.GetEnvironmentVariable("FGA_CLIENT_SECRET"),
        }
    }
};
var fgaClient = new OpenFgaClient(configuration);
```

--------------------------------

### Untitled

No description

--------------------------------

### Initialize OpenFGA SDK Client (Python)

Source: https://docs.fga.dev/modeling/token-claims-contextual-tuples

Provides a Python code example for initializing the OpenFGA SDK client. It imports necessary modules and sets up the client configuration using environment variables for API URL, store ID, and authentication. This is the first step to interact with OpenFGA services from a Python application.

```python
# Checkout the "How to Setup the SDK Client" page for more details.

import os
import openfga_sdk
from openfga_sdk.client import OpenFgaClient, ClientConfiguration
from openfga_sdk.credentials import Credentials, CredentialConfiguration

# FGA_API_URL = 'https://api.us1.fga.dev' // 'https://api.eu1.fga.dev' for EU and 'https://api.au1.fga.dev' for AU
# FGA_STORE_ID = 'YOUR_STORE_ID' - Get this from your store settings in the dashboard, refer to the "How to get your API Keys" page
# FGA_MODEL_ID = 'YOUR_MODEL_ID' - optional, can be overridden per request, helps reduce latency
# FGA_API_TOKEN_ISSUER = 'auth.fga.dev'
# FGA_API_AUDIENCE = 'https://api.us1.fga.dev/' // 'https://api.eu1.fga.dev/' for EU and 'https://api.au1.fga.dev/' for AU
# FGA_CLIENT_ID = 'YOUR_CLIENT_ID' - Get this from your store settings in the dashboard, refer to the "How to get your API Keys" page

configuration = ClientConfiguration(
    api_url=os.environ.get("FGA_API_URL"),
    store_id=os.environ.get("FGA_STORE_ID"),
    authorization_model_id=os.environ.get("FGA_MODEL_ID"),
    credentials=Credentials(
        method=openfga_sdk.credentials.CredentialsMethod.CLIENT_CREDENTIALS,
        config=CredentialConfiguration(
            api_token_issuer=os.environ.get("FGA_API_TOKEN_ISSUER"),
            api_audience=os.environ.get("FGA_API_AUDIENCE"),
            client_id=os.environ.get("FGA_CLIENT_ID"),
            client_secret=os.environ.get("FGA_CLIENT_SECRET"),
        ),
    ),
)

fga_client = OpenFgaClient(configuration)
```

--------------------------------

### Untitled

No description

--------------------------------

### Untitled

No description

--------------------------------

### Initialize OpenFGA Client

Source: https://docs.fga.dev/writing-data/managing-group-membership

Demonstrates how to initialize the OpenFGA client with configuration.

```APIDOC
## Initialize OpenFGA Client

### Description
Initializes the OpenFGA client with necessary configuration parameters, including API URL, store ID, and credentials.

### Method
Initialization

### Endpoint
N/A

### Parameters
#### Environment Variables
- **FGA_API_URL** (string) - Required - The base URL for the FGA API.
- **FGA_STORE_ID** (string) - Required - The ID of the FGA store.
- **FGA_MODEL_ID** (string) - Optional - The ID of the FGA authorization model.
- **FGA_API_TOKEN_ISSUER** (string) - Optional - The API token issuer URL.
- **FGA_API_AUDIENCE** (string) - Optional - The API audience.
- **FGA_CLIENT_ID** (string) - Optional - The client ID for authentication.
- **FGA_CLIENT_SECRET** (string) - Optional - The client secret for authentication.

### Request Example
```java
import dev.openfga.sdk.api.client.OpenFgaClient;
import dev.openfga.sdk.api.configuration.ClientConfiguration;
import dev.openfga.sdk.api.configuration.ClientCredentials;
import dev.openfga.sdk.api.configuration.Credentials;

public class Example {
    public static void main(String[] args) throws Exception {
        var config = new ClientConfiguration()
                .apiUrl(System.getenv("FGA_API_URL")) // If not specified, will default to "https://localhost:8080"
                .storeId(System.getenv("FGA_STORE_ID")) // Not required when calling createStore() or listStores()
                .authorizationModelId(System.getenv("FGA_MODEL_ID")) // Optional, can be overridden per request
                .credentials(new Credentials(
                    new ClientCredentials()
                            .apiTokenIssuer(System.getenv("FGA_API_TOKEN_ISSUER"))
                            .apiAudience(System.getenv("FGA_API_AUDIENCE"))
                            .clientId(System.getenv("FGA_CLIENT_ID"))
                            .clientSecret(System.getenv("FGA_CLIENT_SECRET"))
                ));

        var fgaClient = new OpenFgaClient(config);
    }
}
```

### Response
#### Success Response (200)
N/A

#### Response Example
N/A
```

--------------------------------

### Untitled

No description

--------------------------------

### Initialize OpenFGA Go SDK

Source: https://docs.fga.dev/fga-logging

Demonstrates initializing the OpenFGA client in Go. It uses environment variables for configuration, including API URL, store ID, and authentication credentials. The example shows how to handle potential errors during client initialization.

```go
import (
    "os"

    openfga "github.com/openfga/go-sdk"
    . "github.com/openfga/go-sdk/client"
    "github.com/openfga/go-sdk/credentials"
)

func main() {
    fgaClient, err := NewSdkClient(&ClientConfiguration{
        ApiUrl:               os.Getenv("FGA_API_URL"),   
        StoreId:              os.Getenv("FGA_STORE_ID"),  
        AuthorizationModelId: os.Getenv("FGA_MODEL_ID"),  
        Credentials: &credentials.Credentials{ // Credentials are not needed if connecting to the Playground API
            Method: credentials.CredentialsMethodClientCredentials,
            Config: &credentials.Config{
                ClientCredentialsClientId:       os.Getenv("FGA_CLIENT_ID"),
                ClientCredentialsClientSecret:   os.Getenv("FGA_CLIENT_SECRET"),
                ClientCredentialsApiAudience:    os.Getenv("FGA_API_AUDIENCE"),
                ClientCredentialsApiTokenIssuer: os.Getenv("FGA_API_TOKEN_ISSUER"),
            },
        },
    })

    if err != nil {
        // .. Handle error
    }
}
```

--------------------------------

### Untitled

No description

--------------------------------

### Untitled

No description

--------------------------------

### Initialize OpenFGA SDK Client in .NET

Source: https://docs.fga.dev/writing-data/managing-group-membership

Provides a C# example for initializing the OpenFGA SDK client in a .NET application. It demonstrates setting up the client configuration using environment variables for API URL, store ID, and authentication credentials, which are necessary for subsequent operations.

```csharp
using OpenFga.Sdk.Client;
using OpenFga.Sdk.Client.Model;
using OpenFga.Sdk.Model;
using Environment = System.Environment;

namespace Example;

// Ensure the environment variables are set
```
Tokens:
Raw