So every time that we've been working with the API, we've been doing it over the browser and we have
the special ability where if someone signs in via the normal site, then they can use the API here and
this all works.
But what if you were trying to access the API from a mobile device or via a Kerl command, you would
not have this luxury to be able to, you know, first log in and then do this like you have to do everything
via Jason over an API.
So to sure.
To so you show you what this would look like.
I'm going to make a new tab in my terminal here on the Mac.
It's Command T, it might be different from your system or you could open up a new terminal window.
But wherever it is, let's go ahead and do a curl for our projects.
So we're gonna say Kearl and let's go ahead and just get all the different to DOS that we have, our
current ones, which is just one right now.
But let's go ahead and copy that.
You are also going to copy that.
Come back to my code here and I'm going to say Kerl and I'm going to pass in the Eurail that I'm looking
for and if I hit Enter, it tells me, look, you didn't you don't have any authentication credentials.
We're not going to give you anything which is really good.
We don't want any bit anybody to be able to access these two dos unless that they're their own to do
objects.
Right.
And if we don't know whose they are, we can't even provide them back.
So it really makes sense that this is happening.
But the question is, OK, how do I provide the information for this user, Nic?
Well, using basic authentication, that's what it's called in the jangle risk framework.
If we want to, you know, get this information we can using Kerl do Kerl do the full you are all there
but then also pass a dash, underscore you and then provide inside of a string here like you'll see.
Let me go ahead and stretch this out so you can see what this looks like.
I think it's a little bit bigger.
I'm going to do the user, Nick.
And then you do Colen and then you type the parser, which in my case, I chose the ultra secure ABC
d one, two, three, four.
OK, so I'm going to provide that in a string.
So the dash use for user and it also passes in that password if I hit enter.
Now on this we'll look at this.
Isn't this cool.
It gives me back, you know, the same piece of information here.
And you know, hey, this is how I can add an API to my Web site.
All that good stuff.
And if we wanted to, we also could do posts if we wanted to.
Now, in order for this to happen, we're gonna have to pass on a lot of information, like we're gonna
have to do the flag that says Capital X to specify that this is going to be a post.
And, you know, we're going to say that we're gonna do this for Jason and we're going to type out the
Jason.
And I'd rather not get into that right now because we're gonna be doing this later when we're gonna
learn how to make it so that someone can sign up for an account in log in for an account.
Because what we've seen here, if someone, you know, wants to access the API and use the basic authentication,
well, they can technically.
But what if someone's signing up for the very first time?
You know, because, you know, in our situation, no one needs to, quote, unquote, log in if they're
using the API.
Really, we just from the API perspective, need to know that this is the correct user and that they're
authenticated, like sort of they have the right information to be able to use this API.
And so, you know, we don't really need a log in.
But if someone doesn't have an account or they could never, ever use the site.
And there are some security issues, I think, with using the basic authentication here where people,
every request have to pass in, you know, the username and the password, the big one being that if
this does not go over H.
TDP s, then none of this is going to be encrypted.
And then you've got a big security fund.
You should be using HTP s on your Web site.
But even then, it's just one layer deeper.
And for that we're gonna be using something called authentication tokens.
So really a lot to get to here with authentication.
But I wanted to show you one way that's already built in right now.
But the big topics that we're gonna be diving into is making a sign up form for our API and then also
passing back to the user authentication tokens, which in my opinion, is a much better way to use an
authenticated API.