Accessing Protected APIs

~3 min

When your app needs to call a backend API that requires authentication, use `ThunderIDClient.getAccessToken()` to retrieve a valid access token and attach it as a Bearer token to your requests. The SDK automatically refreshes the token if it has expired.

Accessing Protected APIs

Using HttpURLConnection

The following example calls a protected API endpoint using the standard Android `HttpURLConnection`:

ApiClient.kt

kotlin


suspend fun fetchProtectedResource(thunder: ThunderIDState): String {
    val token = thunder.client.getAccessToken()

    return withContext(Dispatchers.IO) {
        val connection = URL("https://localhost:8090/api/resource").openConnection() as HttpURLConnection
        connection.setRequestProperty("Authorization", "Bearer $token")
        connection.setRequestProperty("Accept", "application/json")

        check(connection.responseCode in 200..299) {
            "Request failed: ${connection.responseCode}"
        }

        connection.inputStream.bufferedReader().readText()
    }
}

Token Refresh

`getAccessToken()` refreshes the access token automatically when it is expired, as long as a valid refresh token is available. You do not need to handle refresh manually. If the refresh token is also expired, `getAccessToken()` throws `IAMException` with code `SESSION_EXPIRED`. Handle this by signing the user out:

kotlin

try {
    val token = thunder.client.getAccessToken()
    // use token
} catch (e: IAMException) {
    if (e.code == IAMErrorCode.SESSION_EXPIRED) {
        runCatching { thunder.client.signOut() }
        thunder.refresh()
    } else {
        println("Unexpected error: $e")
    }
}

Using OkHttp

If your project uses [OkHttp](https://square.github.io/okhttp/), create an `Interceptor` that injects the access token:

ThunderIDInterceptor.kt

kotlin


class ThunderIDInterceptor(private val thunder: ThunderIDState) : Interceptor {
    override fun intercept(chain: Interceptor.Chain): Response {
        val token = runBlocking { thunder.client.getAccessToken() }
        val request = chain.request().newBuilder()
            .addHeader("Authorization", "Bearer $token")
            .build()
        return chain.proceed(request)
    }
}

Using Retrofit

If your project uses [Retrofit](https://square.github.io/retrofit/), combine it with the OkHttp interceptor above:

kotlin

val retrofit = Retrofit.Builder()
    .baseUrl("https://localhost:8090/")
    .client(
        OkHttpClient.Builder()
            .addInterceptor(ThunderIDInterceptor(thunder))
            .build()
    )
    .addConverterFactory(GsonConverterFactory.create())
    .build()

val api = retrofit.create(MyApiService::class.java)