Authentication
The HOLE Foundation API uses Auth0 for authentication, providing enterprise-grade security with OAuth 2.0 / OpenID Connect (OIDC) support.
Overview
All protected endpoints require a valid JWT Bearer token in the Authorization header:
Getting Started
1. Get Your Credentials
Contact us at api@theholefoundation.org to receive:
- Auth0 Domain
- Client ID
- Client Secret (for server-side applications)
- API Audience
2. Choose Authentication Method
We support three authentication flows:
OAuth 2.0 Flow (User Authentication)
Best for web applications where users log in with their credentials.
Step 1: Redirect to Auth0
Step 2: Handle Callback
After user logs in, Auth0 redirects back with an authorization code:
Step 3: Use Access Token
Machine-to-Machine (M2M) Authentication
Best for backend services, cron jobs, and server-to-server API calls.
Step 1: Get M2M Token
Response:
Step 2: Use M2M Token
Step 3: Handle Token Refresh
M2M tokens expire after 24 hours. Implement token caching and refresh:
API Scopes
Different endpoints require different scopes:
Token Validation
The API validates JWT tokens on every request:
- Signature verification - RS256 algorithm with Auth0 public keys
- Issuer check - Must be
https://dev-4fszoklachwdh46m.us.auth0.com/ - Audience check - Must be
https://api.theholefoundation.org - Expiration check - Token must not be expired
- Scope validation - Token must have required scopes
Error Responses
401 Unauthorized
Token is missing or invalid:
403 Forbidden
Token is valid but lacks required scopes:
Security Best Practices
✅ DO
- Store credentials in environment variables
- Use HTTPS for all API calls
- Implement token refresh logic
- Set appropriate token expiration times
- Rotate secrets regularly
- Use different credentials for dev/prod
❌ DON’T
- Hardcode credentials in source code
- Commit secrets to version control
- Share tokens between environments
- Use user tokens for M2M operations
- Store tokens in localStorage (web apps)
- Log tokens or credentials
Example: Complete M2M Flow
Testing Authentication
Use our health endpoint to verify your token:
Success response:
Need Help?
- 📧 Email: api@theholefoundation.org
- 💬 Discord: Join our community
- 📚 Auth0 Documentation: auth0.com/docs