Your API account

curl "https://api.main-team.org/v1/api-account/validate-me" \
  -H "Authorization: Bearer $TOKEN"

{
  "_id": "66f1c2a9e4b0a1d2c3f4a5b6",
  "apiKey": "key_Q2x5cGhvbnktZXhhbXBsZS1r",
  "companyName": "Northwind Learning",
  "scopes": [],
  "roles": [
    { "effect": "allow", "action": "api/*", "target": "mto" },
    { "effect": "allow", "action": "*/read", "target": "*" },
    { "effect": "allow", "action": "student/*", "target": "mto" },
    { "effect": "allow", "action": "student/update", "target": "*" },
    { "effect": "allow", "action": "auth/signin", "target": "*" },
    { "effect": "allow", "action": "application/*", "target": "*" },
    { "effect": "disallow", "action": "application/delete", "target": "*" }
  ],
  "isActive": true
}

import jwt from 'jsonwebtoken';

const BASE = 'https://api.main-team.org/v1';
const API_KEY = process.env.MTO_API_KEY;
const API_SECRET = process.env.MTO_API_SECRET;

function mintToken(lifetimeSeconds = 900) {
  const now = Math.floor(Date.now() / 1000);
  return jwt.sign({ sub: API_KEY, iat: now, exp: now + lifetimeSeconds }, API_SECRET, {
    algorithm: 'HS256',
    keyid: API_KEY,
  });
}

export async function checkCredentials(requiredActions = []) {
  const res = await fetch(`${BASE}/api-account/validate-me`, {
    headers: { Authorization: `Bearer ${mintToken(60)}` },
  });
  if (res.status === 401) throw new Error('Token refused: check key, secret, clock and account status');
  if (res.status === 403) throw new Error('Token valid, but the account lacks api/*');
  if (!res.ok) throw new Error(`validate-me: HTTP ${res.status}`);

  const account = await res.json(); // no envelope on this route
  const allowed = new Set(
    account.roles.filter((r) => r.effect === 'allow').map((r) => r.action),
  );
  const missing = requiredActions.filter((a) => !allowed.has(a));
  return { account, missing }; // a plain string match; see /api/permissions for wildcards
}

<?php
use Firebase\JWT\JWT; // composer require firebase/php-jwt

const MT_BASE = 'https://api.main-team.org/v1';

function mt_mint_token(int $lifetimeSeconds = 900): string
{
    $apiKey = getenv('MTO_API_KEY');
    $now = time();
    $payload = ['sub' => $apiKey, 'iat' => $now, 'exp' => $now + $lifetimeSeconds];
    return JWT::encode($payload, getenv('MTO_API_SECRET'), 'HS256', $apiKey);
}

function mt_check_credentials(): array
{
    $ch = curl_init(MT_BASE . '/api-account/validate-me');
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER => ['Authorization: Bearer ' . mt_mint_token(60)],
        CURLOPT_TIMEOUT => 30,
    ]);
    $raw = curl_exec($ch);
    $status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
    curl_close($ch);

    if ($status === 401) throw new RuntimeException('Token refused: check key, secret, clock and account status');
    if ($status === 403) throw new RuntimeException('Token valid, but the account lacks api/*');
    if ($status !== 200) throw new RuntimeException("validate-me: HTTP $status");

    return json_decode($raw, true); // the account itself, not an envelope
}

curl -X POST "https://api.main-team.org/v1/api-account/revoke-token" \
  -H "Authorization: Bearer $TOKEN"

{
  "success": true,
  "message": "Token revoked successfully",
  "data": { "expiresIn": 1830 }
}

export async function revoke(token) {
  const res = await fetch(`${BASE}/api-account/revoke-token`, {
    method: 'POST',
    headers: { Authorization: `Bearer ${token}` },
  });
  if (res.status === 401) return { alreadyUnusable: true };
  if (!res.ok) throw new Error(`revoke-token: HTTP ${res.status}`);
  const { data } = await res.json();
  return { expiresIn: data.expiresIn };
}

// On shutdown:
// process.on('SIGTERM', async () => { await revoke(currentToken); process.exit(0); });

<?php
function mt_revoke(string $token): ?int
{
    $ch = curl_init(MT_BASE . '/api-account/revoke-token');
    curl_setopt_array($ch, [
        CURLOPT_POST => true,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER => ['Authorization: Bearer ' . $token],
        CURLOPT_TIMEOUT => 30,
    ]);
    $raw = curl_exec($ch);
    $status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
    curl_close($ch);

    if ($status === 401) return null; // already unusable
    if ($status !== 200) throw new RuntimeException("revoke-token: HTTP $status");
    return json_decode($raw, true)['data']['expiresIn'];
}