Service accounts: let your code use other services without passwords

import { defaultCredential } from '@thailandhosting/identity';
import { Client as Queues } from '@thailandhosting/queue-service';

// In a Container or Function this needs nothing. Elsewhere set
// TH_CLIENT_ID and TH_CLIENT_SECRET.
const cred = defaultCredential();

const queues = new Queues({ region: 'th-bkk-1', tokenProvider: () => cred.getToken() });

// From outside the platform. In a Container or Function, click Connect instead.
const login = await cred.databaseCredentials('orders');
const pool = new pg.Pool({ connectionString: login.private.url });

from thailandhosting_identity import default_credential
from thailandhosting_queueservice import Client as Queues

# In a Container or Function this needs nothing. Elsewhere set
# TH_CLIENT_ID and TH_CLIENT_SECRET.
cred = default_credential()

queues = Queues(region="th-bkk-1", token_provider=cred.get_token)

# From outside the platform. In a Container or Function, click Connect instead.
login = cred.database_credentials("orders")
conn = psycopg.connect(login["private"]["url"])

import identity "github.com/mrzack99s/thailandhosting-identity-sdk-go"

// In a Container or Function this needs nothing. Elsewhere set
// TH_CLIENT_ID and TH_CLIENT_SECRET.
cred, err := identity.Default()

queues, err := queueservice.New(queueservice.Config{Region: "th-bkk-1", TokenSource: cred.TokenSource("")})

// From outside the platform. In a Container or Function, click Connect instead.
login, err := cred.DatabaseCredentials(ctx, "orders")
db, err := sql.Open("pgx", login.Private.URL)

# Inside a Container or Function. The address answers only there.
curl -H 'Metadata: true' http://169.254.169.254/identity/oauth2/token

# For calling another Container, name it as the audience:
curl -H 'Metadata: true' 'http://169.254.169.254/identity/oauth2/token?audience=https://orders.containers.th-bkk-1.thailandhosting.com'

# {"access_token":"eyJ...","token_type":"Bearer","expires_in":3600,"expires_on":1793355792,"client_id":"sa-..."}

# From anywhere, with a client ID and secret (OAuth 2.0 client credentials).
curl https://api.thailandhosting.com/v1/identity/token \
  -d grant_type=client_credentials \
  -d client_id=$TH_CLIENT_ID \
  -d client_secret=$TH_CLIENT_SECRET

# Queue Service and Object Storage: send the token as a bearer.
curl -H "Authorization: Bearer $TOKEN" https://queues.thailandhosting.com/th-bkk-1/v1/queues/jobs/messages -d '{"body":"hello"}'

# Database or Cache, from outside the platform: exchange the token for a login.
# In a Container or Function, click Connect and use the URL it adds instead.
curl -H "Authorization: Bearer $TOKEN" https://api.thailandhosting.com/v1/identity/database-credentials -d '{"database":"orders"}'
# {"username":"sa_...","password":"...","database":"orders","expiresAt":"...","private":{"host":"orders.internal","port":5432,"url":"postgresql://..."}}

# Another Container or Function: a token made for its address.
curl -H "Authorization: Bearer $TOKEN" https://orders.containers.th-bkk-1.thailandhosting.com/items

<?php // PHP, inside a Container or Function
$ctx = stream_context_create(['http' => ['header' => "Metadata: true\r\n"]]);
$token = json_decode(file_get_contents('http://169.254.169.254/identity/oauth2/token', false, $ctx))->access_token;

// Java 11+, inside a Container or Function
var client = HttpClient.newHttpClient();
var request = HttpRequest.newBuilder(URI.create("http://169.254.169.254/identity/oauth2/token"))
    .header("Metadata", "true").build();
var body = client.send(request, HttpResponse.BodyHandlers.ofString()).body();
// Read access_token and expires_on with your JSON library.

// C#, inside a Container or Function
using var http = new HttpClient();
http.DefaultRequestHeaders.Add("Metadata", "true");
var body = await http.GetStringAsync("http://169.254.169.254/identity/oauth2/token");
var token = JsonDocument.Parse(body).RootElement.GetProperty("access_token").GetString();

# Ruby, inside a Container or Function
require 'net/http'; require 'json'
uri = URI('http://169.254.169.254/identity/oauth2/token')
token = JSON.parse(Net::HTTP.get(uri, 'Metadata' => 'true'))['access_token']

# Published keys (JWKS) and discovery, for any JWT library:
https://api.thailandhosting.com/v1/identity/keys
https://api.thailandhosting.com/v1/identity/.well-known/openid-configuration
# Check: alg ES256, iss https://api.thailandhosting.com/v1/identity, aud your own name, exp, nbf.