What is User authentication?
User authentication means that the client making the request is authenticating as a user, which means that Bubble can determine what they are authorized to access using privacy rules, just like regular app users.
This is the method that offers the highest level of security and flexibility since it allows you to provide different privacy rules based on who the client is.
You can set the access level for an API workflow using the Authentication setting. This determines whether the workflow can be accessible to everyone, to authenticated users and admins, or to admins only.
Article section: API workflow access level
How to set up User authentication
In principle, logging a client in as a user happens in the same way that you log in a regular user in your app, except that the action needs to happens in an API workflow. When you log in a user, Bubble can return a token that can be used to authenticate in subsequent calls.
Create an API Workflow with a fitting name such as
generate-api-tokenUse the Log the User in action or Sign the user up action to log in or create a new user. For the Log the User in action you will need to provide an email and a password.
If successful, Bubble will automatically respond with a token that can be used as a bearer token in subsequent call.
If you log a user in with an action in an API Workflow, Bubble will respond with a token that can be used to authenticate the client in subsequent requests. In the example above we are accepting the email and password as parameters in the API Workflow.
How long is the token valid?
Note: Tokens that remain unused expire after 30 days, even if their total validity period is longer. If the token is used within the 30-day window, its validity is automatically extended by 30 days, up to its maximum duration.
To prevent the token from expiring, you can send a simple no-op workflow request to the API to keep it active.
The token has two different validities depending on your settings.
Without 2-factor authentication
Keep the user logged in set to yes: the token has a validity of 12 months
Keep the user logged in set to no: the token has a validity of 24 hours
With 2-factor authentication
Keep the user logged in set to yes: the token has a validity of 1 month
Keep the user logged in set to no: the token has a validity of 24 hours
Revoking a token
There are two ways to revoke a token after it has been generated:
You can call a Log the User out action from the client that uses the relevant token
You can use the Log out other user's sessions to sign a User out from every session except for the one they are running the workflow from
Restricting a client's privileges
There are two ways to restrict the access level and privileges of a client that's using a user token:
Privacy rules: your main level of protection is setting up privacy rules that match the User that is signed in and control their access to find, read, create, edit and delete data through the API.
Conditions: on API Workflows you can set up conditions that restrict the triggering of the workflow based on fields saved on the User. This will apply to clients who are sending a request with a user authentication token.