--- title: SSO for REST APIs with your custom JWT authentication author: Hue Team type: post date: 2021-09-14T00:00:00+00:00 url: /blog/2021-09-14-sso-for-rest-apis-with-your-custom-jwt-authentication sf_thumbnail_type: - none sf_thumbnail_link_type: - link_to_post sf_detail_type: - none sf_page_title: - 1 sf_page_title_style: - standard sf_no_breadcrumbs: - 1 sf_page_title_bg: - none sf_page_title_text_style: - light sf_background_image_size: - cover sf_social_sharing: - 1 sf_related_articles: - 1 sf_sidebar_config: - left-sidebar sf_left_sidebar: - Sidebar-2 sf_right_sidebar: - Sidebar-1 sf_caption_position: - caption-right sf_remove_promo_bar: - 1 ampforwp-amp-on-off: - default categories: - Version 4.11 - Development ---
Leveraging Hue as an API Service
The Hue SQL Editor allows you to query any Database or Data Warehouse. Initially Hue had private APIs which could be used by the Hue UI only (because they could've changed, auth cookie based, lot of historical parameters etc). For example, if anyone had set up their own Hue instance, then it was very difficult for any other external services to use the APIs which Hue provides. ## Rest API With the [introduction of Public APIs](https://docs.gethue.com/developer/api/rest/), any external service can see Hue as an API server and use all the end user functionalities under the hood via [JWT Authentication](https://docs.gethue.com/developer/api/rest/#authentication). For authentication, we use [djangorestframework-simplejwt](https://django-rest-framework-simplejwt.readthedocs.io/en/latest/) to generate a Hue JWT which can be passed as a Bearer token to access the APIs. This is what powers the Hue web components such as [SQL Scratchpad](https://docs.gethue.com/developer/components/scratchpad/)! ## Custom Authentication But now let's think of a scenario where an external service or application wants to generate and use their own JWT for authentication? Maybe for easier injection of [Scratchpad component](https://docs.gethue.com/developer/components/scratchpad/) into a separate web app? Or the external service wanting to generate their own JWT with their own specifications? To resolve this issue, we implemented an option of custom JWT authentication (thanks to [Django REST Framework](https://www.django-rest-framework.org/api-guide/authentication/#custom-authentication) custom pluggability)! Basically if it's enabled, then Hue will accept your JWT in the request headers and let you access the public APIs, provided the signature is valid ;)  - Your web service sends the JWT as bearer token in request headers of the API called. - Custom auth in Hue first fetches the public key from the auth server and then using it, decodes the JWT to extract the user information. - To access external services like Impala etc. via Hue, the JWT is further passed on to Impala for it to decode and let your external web service access Impala via Hue seamlessly. To enable the auth backend, make the following changes in the `hue.ini`: [desktop] [[auth]] [[[jwt]]] is_enabled=true key_server_url=https://ext_authz:8000 issuer=