JWT Authentication

Dev Community Dev/API Corner
,
21

Thanks @marcelopazzo, this answers my original question regarding the need for a legacy Plex token.

However, I am unable to get the Plex JWT from the last step.

After the user signs in to the Plex login page (from the auth url), I query the pin endpoint with my signed device JWT, but there is no Plex JWT in the response.

Thanks, @BigWheel edited the tags for me. :slight_smile:

22

Did you get any error, or just a plain legacy token in the authToken field? If any fields are missing in the device JWT provided, the endpoint should return an error message with the details.

23

I kept getting a legacy token in the authToken field.

After more fiddling around, I think I found the problem. The pin endpoint

GET https://clients.plex.tv/api/v2/pins/<pinID>?deviceJWT=<signedJWT>

does not work with a JSON response. As soon as I remove the Accept: application/json header and use the XML response it is working and I get the Plex JWT in the authToken field.

Second question, does this Plex JWT authentication method work with the 4 digit code method used at https://plex.tv/link (i.e. without strong=true) instead of using the auth URL?

2 Likes
25

Should work the same, itā€™s meant to allow anything, including TV apps, to use JWT tokens.

Iā€™ll review the endpoint to see whatā€™s going on with the json response. Thanks for finding that out! :plexheart:

26

Using the 4 digit code also just returns a legacy token (using either JSON or XML responses).

27

Sorry for the delay in getting back to you, but with a 4-digit code, you will need to use the http://plex.tv/link interface instead of the /auth page. Is there any scenario where we need to use a short pin on the /auth interface?

28

I am entering the 4-digit code on https://plex.tv/link.

29

I think everything is actually working properly. Both XML and JSON and both OAuth or 4-digit code.

I needed to generate a completely new client identifier and keypair to properly do a clean test of each method. Trying to reuse the same client identifier or keypair when swapping between XML and JSON or between OAuth and 4-digit code causes issues.

30

Any plans to actually implement API level keys? similar to how other platforms do it? for example, currently in WatchState which is a tool that allow plex server owner to sync their user play state rely on admin token to generate sub tokens for users which has access to plex server.

Ideally, there will be API keys that could be used with tools and users are identified by their IDs and their data accessed that way.

Plex currently has:

1- main user

2- home users

3- users whom have access to the server

generating keys and tokens and trying to keep all of those in sync is rather difficult. Also,

Also i am not sure if this is the case, but users who has access to the server who arenā€™t home users, are supposed to be different account yeah? if so isnā€™t uploading pubkey to their account kind expose them to more security issues?

currently tokens are tied to the server not an account afaik