> For the complete documentation index, see [llms.txt](https://atd-dts.gitbook.io/moped-documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://atd-dts.gitbook.io/moped-documentation/dev-guides/how-tos/how-do-i-get-a-jwt-token.md).

# How do I get a JWT token?

## Javascript Web Tokens (JWTs)

A token is basically a passport, it has information about the user, like the name, email, certificate origin (AWS, Google, etc), it has an expiration date, etc. This "passport" in the form of a long encoded token is the way we communicate with our Hasura GraphQL instance and the [Moped API](https://github.com/cityofaustin/atd-moped/tree/main/api).

Hasura needs the token to know the roles of the user, and makes sure this token is valid by checking it was received through a valid email/password or SSO login from AWS directly. The case is the same with the [Moped API](https://github.com/cityofaustin/atd-moped/tree/main/api), but the only difference is that we make the validation ourselves in the API.

To pass this token, we use the standard HTTP header `Authorization` , much like this:

```
Authorization: Bearer <TOKEN STRING HERE>
```

{% hint style="info" %}
&#x20;Tokens are currently programed to expire frequently as defined in our AWS Cognito user pool configurations. The frontend code is designed to watch for token expiration and renew when needed prior to making network requests that could fail with an expired token.
{% endhint %}

### Not all Tokens are Created Equal

Our auth setup creates two types of tokens depending on if a user logs in with email/password and City of Austin Single Sign-On (AzureAD). There are two different environments: 1) Local/staging and 2) Production.&#x20;

The main difference between the Cognito token and the Single Sign-On is in the contents of the token, the SSO token is longer and has more information about Active Directory.

1\) Local/Staging. The tokens for local/staging only work for local or staging use. This is true for the local/staging Hasura, or local/staging API (flask app).

2\) Production. The tokens for production, only work for the production hasura instance or the API.

### Where can I find it?

1. Log in to Moped (if you need access to local/staging) launch the local instance or log in to the staging moped instance.
2. Once logged in, in Chrome find the developer console look for a `graphql` network request
3. Look at the **Authorization** request header, and you will find a long JWT token that you can decode using a site like [jwt.io](https://www.jwt.io/) &#x20;

The decoded token looks like this, from this example, you can see this is a Single Sign-On token, given the extra identity details related to Microsoft AzureAD:

```
{
  "at_hash": "vgVAwX-6X_R0Pq71q8OWqw",
  "sub": "0cf74300-8469-4178-903a-6f40fdf28c07",
  "cognito:groups": [
    "us-east-1_Zc3pNWX51_AzureAD"
  ],
  "email_verified": false,
  "https://hasura.io/jwt/claims": "{\"x-hasura-user-id\": \"8154223e-0dee-480c-8b6c-a33d6a963dd9\", \"x-hasura-default-role\": \"moped-viewer\", \"x-hasura-allowed-roles\": [\"moped-admin\"], \"x-hasura-user-db-id\": \"185\", \"x-hasura-user-wg-id\": \"3\"}",
  "iss": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_Zc3pNWX51",
  "cognito:username": "azuread_mike.dilley@austintexas.gov",
  "nonce": "jLMhxwQEfUmZTAEsJULKUI6xP3rX8gE9NAoR55L-APNShDSZKz7At5oTzapvhEiQ5Jexj4E6oxUxMTCvkQxkIT-W-NKwK9CHSblj7513LE3uDo10MN5XNgKGmIPoHt2-V6EM9Zhwq0ucdDnXNPFwKwtph0aoepSfO_IFGJwMrr0",
  "aud": "ins01e2a8d3vd8apvnd0jv10c",
  "identities": [
    {
      "dateCreated": "1652215667254",
      "userId": "Mike.Dilley@austintexas.gov",
      "providerName": "AzureAD",
      "providerType": "SAML",
      "issuer": "https://sts.windows.net/5c5e19f6-a6ab-4b45-b1d0-be4608a9a67f/",
      "primary": "true"
    }
  ],
  "token_use": "id",
  "auth_time": 1784669465,
  "exp": 1784670365,
  "iat": 1784669467,
  "email": "Mike.Dilley@austintexas.gov"
}
```

An example of a token from a token retrieved through email/password login looks like:

```
{
  "sub": "8154223e-0dee-480c-8b6c-a33d6a963dd9",
  "email_verified": true,
  "https://hasura.io/jwt/claims": "{\"x-hasura-user-id\": \"8154223e-0dee-480c-8b6c-a33d6a963dd9\", \"x-hasura-default-role\": \"moped-viewer\", \"x-hasura-allowed-roles\": [\"moped-admin\"], \"x-hasura-user-db-id\": \"185\", \"x-hasura-user-wg-id\": \"3\"}",
  "iss": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_Zc3pNWX51",
  "cognito:username": "8154223e-0dee-480c-8b6c-a33d6a963dd9",
  "aud": "ins01e2a8d3vd8apvnd0jv10c",
  "event_id": "b9663f24-5418-4767-a0f7-a6e6c8cb0dc1",
  "token_use": "id",
  "auth_time": 1783630549,
  "exp": 1784670240,
  "iat": 1784669341,
  "email": "mike.dilley@austintexas.gov"
}
```