#hypothes.is

<jassmith> I've been attempting to generate and use a grantToken, but am getting "error: unauthorized_client" from the /api/token endpoint on my self hosted system. Couldn't find any docs describing how to configure the host, but found this https://groups.google.com/a/list.hypothes.is/fo... it indicates that the server needs CLIENT_ID, CLIENT_SECRET and SECRET_KEY. I've tried using both CLIENT_SE

tested the generated jwt on jwt.io (they validate) , but never get anything else from the service

<jassmith> Given ``` CLIENT_ID='123456789' CLIENT_OAUTH_ID='79a9bca6-f18a-11e7-8857-37ed8118ea77' CLIENT_SECRET='Anaconda da vida baby... python' SECRET_KEY='11111111-2222-3333-4444-555555555555'

server, what are the appropriate values for aud, iss, sub I assume: ``` aud = [my h server domain] iss = '79a9bca6-f18a-11e7-8857-37ed8118ea77' sub = acct:[my username]@[my h server domain]

<jassmith> @robertknight thanks in advance

<robertknight> @jassmith - That mailing list thread is out of date with respect to client authentication. See http://h-client.readthedocs.io/en/latest/develo...

<robertknight> The only env vars that matter now are `CLIENT_OAUTH_ID` , `CLIENT_URL` (set before running “h”) and `SIDEBAR_APP_URL` (set before running the client)

<jassmith> an hmac relies on a secret, what am I supposed to be using for it?

<jassmith> I'm trying to externally generate the grantToken to be used in the js-hypothesis-config.

<robertknight> I re-read your message from yesterday. I gather you are trying to use our third-party accounts feature. For that, see the README of https://github.com/hypothesis/publisher-account... for instructions on how to set it up and a working demo site.

<jassmith> excellent, I'll review. Thanks

<robertknight> Note that this comment early in the README: “Note that this is only intended for us at Hypothesis to test the integration functionality internally, it’s not intended as a demo or example for publishers.” is purely there to reflect the fact that the demo site is ugly as sin and not designed for use in marketing materials etc.

<jassmith> I'm trying to avoid having to challenge a user for a login, and to use the existing SSO to issue an appropriate JWT. Is that not an expected use case?

<robertknight> That’s exactly what third party accounts is for.

<jassmith> it was this bit that left me wondering " not intended as a demo or example"

<robertknight> Ignore that.

<jassmith> ah I understand now

<jassmith> sorry

<jassmith> too early, need more coffee. You've made my life easier, thank you!