To confirm the token works, you can have your bot make a simple GET request to /api/v4/users/me with the Authorization: bearer in the header. Include the Token as part of the Authorization header on API requests from your integration. Then re-send the request that received the 401 status code. When your bot receives this response, it should re-apply the login logic (using the above steps) to get another session token. If the session token your bot is using expires, it will receive a 401 Unauthorized response from requests using that token. Note: Each session token has an expiry time, set depending on the server’s configuration. The bot should retrieve the session token from the Token header and store it in memory for use with future requests. HTTP / 1.1 200 OK Set - Cookie : MMSID = hyr5dmb1mbb49c44qmx4whniso Path =/ Max - Age = 2592000 HttpOnly Token : hyr5dmb1mbb49c44qmx4whniso X - Ratelimit - Limit : 10 X - Ratelimit - Remaining : 9 X - Ratelimit - Reset : 1 X - Request - Id : smda55ckcfy89b6tia58shk5fh X - Version - Id : developer Date : Fri, 13 : 21 : 14 GMT Content - Length : 657 Content - Type : application / json charset = utf - 8 Set up your bot to make an HTTP POST to /api/v4/users/login with a JSON body, including the bot account’s email and password. The session token is used to authenticate to the Mattermost system.
#Mattermost integration password
Have your integration use the email and password with an /api/v4/login endpoint to retrieve a session token. Provide the email and password to your integration, and store it in a secure location with restricted access. Not recommended in production due to potential security vulnerabilities. In a testing environment, you may also make the bot account a System Admin, giving the bot permissions to post to any channel.
If your deployment has a lot of teams or channels, you may create a CLI script to automate the process. Manually add the account to all teams and channels it needs access to.
How do I create a bot account without personal access tokens or webhooks? ¶ĭeployments that cannot create bot accounts via webhooks due to security reasons and do not want to use personal access tokens with no expiry time, can use the following approach:Ĭreate a bot account using a secure email and strong password.
0 kommentar(er)
