Authentication

# 1. Exchange the key for a token.
curl -X POST https://maatstays.wtf/v1/token \
  -H "Authorization: Bearer $MAAT_PARTNER_KEY"

# → 200
# {
#   "access_token": "eyJhbGciOiJIUzI1NiIs…",
#   "token_type": "Bearer",
#   "expires_in": 900,
#   "workspace_id": "3f6b0f2e-1c3a-4d5e-9a70-8b2c4d6e0f11",
#   "sandbox": true,
#   "scope": ["partner:token.issue", "catalog:write", "calendar:read",
#             "calendar:write", "webhooks:manage"]
# }

# 2. Call the API with the token.
curl https://maatstays.wtf/v1/blocks \
  -H "Authorization: Bearer $MAAT_PARTNER_TOKEN"

const keyExchange = await fetch('https://maatstays.wtf/v1/token', {
    method: 'POST',
    headers: { Authorization: `Bearer ${process.env.MAAT_PARTNER_KEY}` },
});

if (!keyExchange.ok) {
    // One indistinguishable 401 covers an unknown key, a revoked key
    // and a wrong secret.
    throw new Error(`token exchange failed: ${keyExchange.status}`);
}

const { access_token: token, expires_in: expiresIn } = await keyExchange.json();

// Use the token for a batch of work, then let it expire.
const res = await fetch('https://maatstays.wtf/v1/blocks', {
    headers: { Authorization: `Bearer ${token}` },
});
console.log(res.status, expiresIn);

import os

import requests

exchange = requests.post(
    "https://maatstays.wtf/v1/token",
    headers={"Authorization": f"Bearer {os.environ['MAAT_PARTNER_KEY']}"},
    timeout=30,
)
exchange.raise_for_status()
token = exchange.json()["access_token"]

# Use the token for a batch of work, then let it expire.
res = requests.get(
    "https://maatstays.wtf/v1/blocks",
    headers={"Authorization": f"Bearer {token}"},
    timeout=30,
)
print(res.status_code)

package main

import (
    "encoding/json"
    "fmt"
    "log"
    "net/http"
    "os"
)

func main() {
    req, _ := http.NewRequest(http.MethodPost,
        "https://maatstays.wtf/v1/token", nil)
    req.Header.Set("Authorization", "Bearer "+os.Getenv("MAAT_PARTNER_KEY"))

    res, err := http.DefaultClient.Do(req)
    if err != nil {
        log.Fatal(err)
    }
    defer res.Body.Close()
    if res.StatusCode != http.StatusOK {
        log.Fatalf("token exchange failed: %d", res.StatusCode)
    }

    var body struct {
        AccessToken string `json:"access_token"`
        ExpiresIn   int    `json:"expires_in"`
    }
    if err := json.NewDecoder(res.Body).Decode(&body); err != nil {
        log.Fatal(err)
    }

    // Use body.AccessToken for a batch of work, then let it expire.
    fmt.Println("token expires in", body.ExpiresIn, "seconds")
}