Format Response Token
Struktur response token dan ID token OIDC SSO Tabalong.
Token Response
{
"access_token": "eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9...",
"token_type": "Bearer",
"expires_in": 3600,
"refresh_token": "dGhpcyBpcyBhIHJlZnJlc2ggdG9rZW4...",
"id_token": "eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9...",
"scope": "openid profile email organization"
}Penjelasan Field
| Field | Tipe | Keterangan |
|---|---|---|
access_token | string | Token untuk mengakses resource |
token_type | string | Selalu Bearer |
expires_in | number | Waktu kadaluarsa dalam detik |
refresh_token | string | Token refresh (hanya jika scope offline_access) |
id_token | string | JWT identitas user (OIDC) |
scope | string | Scope yang disetujui |
Algoritma Tanda Tangan
ID token ditandatangani dengan EdDSA. Ambil public key dari JWKS:
https://bukutamu.tabalongkab.go.id/api/auth/jwksJangan asumsikan RS256 — ikuti id_token_signing_alg_values_supported dari discovery.
Struktur ID Token (Decoded)
{
"header": {
"alg": "EdDSA",
"typ": "JWT"
},
"payload": {
"iss": "https://bukutamu.tabalongkab.go.id/api/auth",
"sub": "user_id_12345",
"aud": "YOUR_CLIENT_ID",
"exp": 1704067200,
"iat": 1704063600,
"nonce": "abc123",
"name": "John Doe",
"email": "[email protected]",
"email_verified": true,
"picture": "https://example.com/avatars/user.jpg",
"nip": "198501012010011001",
"jabatan": "Analis Kebijakan",
"golongan": "III/c - Penata",
"skpd": "Dinas Komunikasi dan Informatika",
"skpdId": "123"
}
}Validasi
iss: harus tepathttps://bukutamu.tabalongkab.go.id/api/auth(dengan/api/auth). Menolak token jikaisshanya origin tanpa path tersebut.