SendBird strong security strategy

sendbird.md

1. Create an application (manual)

After login, go to your app Dashboard to discover:

• APP_ID is your app authentication. Using the same accross all your Android/iOS clients is allowing to access same content.

• API_TOKEN or in other words your Master API Token. This token is like your Bitcoin private key. NEVER SEND IT TO YOUR CLIENTS!

To use the Platform API with a specific application, you must authenticate a request using your API Token. You can find the token in your Dashboard under Overview - App Credentials. And the API Token you'll find in your Dashboard is a Master API Token. Master API Token is issued when an application is created, and it cannot be revoked or changed.
With Master API Token, you can issue an API Token with it, revoke other API Token, or list up API Tokens issued. As stated above, an API Token must be included in your HTTP Request Header for authentication.

• API_URL = https://api.sendbird.com

2. Create a new user (backend)

For each of your user, create a new SendBird user with issue_access_token =true in order to generate a unique user access token:

{
  "user_id": "john123",
  "nickname": "Johnny",
  "profile_url": "https://sendbird.com/main/img/profiles/profile_05_512px.png",
  "access_token": "07a0ccf6d3e801223e65b06b6066352e0512b43c",
  "is_online": false,
  "last_seen_at": 0
}

Returned access_token will be called USER_ACCESS_TOKEN, and is not time limited, no need to refresh it.

3. Use user specific credentials in clients (frontend)

Use APP_ID + USER_ACCESS_TOKEN retrieved from your server in order to login:

SendBird.connect(USER_ID, USER_ACCESS_TOKEN, new ConnectHandler() {
    @Override
    public void onConnected(User user, SendBirdException e) {
        if (e != null) {
            // Error.
            return;
        }
    }
});

Sources

How to build an iOS messaging app: Part 1 - Basic Login View

summary.jpeg