Authenticate

What it is

A backend calls Manta with a Keycloak access token sent as a bearer token. Mint it for a service account with mintWithClientCredentials from @manta-eu/auth. The token acts as that account, so it reaches only the datastores the account has been granted.

Import

import { mintWithClientCredentials } from "@manta-eu/auth";

Example

const accessToken = await mintWithClientCredentials({
  baseUrl,
  realm,
  clientId,
  clientSecret,
  scope,
});

Request

Pass one credentials object:

• baseUrl — Keycloak origin.
• realm — realm name.
• clientId — service-account client id.
• clientSecret — client secret.
• scope — optional. When you omit it, the request sends no scope.

The function posts application/x-www-form-urlencoded to {baseUrl}/realms/{realm}/protocol/openid-connect/token with grant_type=client_credentials, client_id, client_secret, and scope when you set it.

Response

The call resolves to the access_token string. Send it on later requests as Authorization: Bearer <accessToken>. If Keycloak refuses the client, the function throws, and the error includes the HTTP status and the realm.