DK StudioAPI
REST service · port 3003

DK Studio API

Authentication for DK Studio, served as a standalone service. It signs a user in through Feishu or through your SSO provider and hands the session back to the Studio. The Studio does not depend on it, and it holds no test data of its own.

Read the documentationSee the endpoints

The endpoints

Four routes, all of them a redirect in or out. Two start a sign-in, two receive the provider's answer.

GET/api/auth/feishu

Start a Feishu sign-in

Redirects to the Feishu authorisation page with the application id and the configured redirect URI. The user leaves the studio here and comes back on the callback route.

GET/api/auth/sso

Start an SSO sign-in

Redirects to the SSO provider with the client id, requesting the openid, profile and email scopes. The user returns on the SSO callback route.

GET/api/auth/feishu/callback

Feishu callback

Handles the provider's answer: exchanges the authorisation code, establishes the session, and sends the user on to the Studio.

GET/api/auth/sso/callback

SSO callback

The same exchange for the SSO provider. Both callbacks read the code from the query string and refuse a request that arrives without one.

How a sign-in flows

The service never holds a password. It sends the user to the provider, and the provider comes back with a code.

  1. 1

    The client asks for a sign-in

    The Studio opens the Feishu or SSO authorisation route in the user's browser.

  2. 2

    The service hands off to the provider

    The user is redirected to the provider with the client id, the redirect URI and the scopes the service needs.

  3. 3

    The provider answers

    The provider calls the matching callback route with an authorisation code.

  4. 4

    The session is established

    The code is exchanged, the session is created, and the user lands back in the Studio.

Configuration

Six environment variables, read from the environment the service runs in. Put them in .env.local. .env.local

VariableDefaultMeaning
FEISHU_APP_ID—The Feishu application id. The Feishu authorisation route refuses to start without it.
FEISHU_REDIRECT_URIhttp://localhost:3003/api/auth/feishu/callbackWhere Feishu sends the user back.
SSO_CLIENT_ID—The client id issued by the SSO provider. The SSO authorisation route refuses to start without it.
SSO_URLhttps://sso.ingeek.comThe SSO provider.
SSO_REDIRECT_URIhttp://localhost:3003/api/auth/sso/callbackWhere the SSO provider sends the user back.
WEB_URLhttp://localhost:3000Where the user is sent after a successful sign-in.

Run it locally

The service runs on port 3003 in both development and production.

pnpm --filter api dev      # http://localhost:3003
pnpm --filter api build
pnpm --filter api start    # serves the build on http://localhost:3003