Posting a file to an outside API with a JSON web token

Question

I am trying to upload a database file to an outside organization's API using R. I have a username and password, as well as an separate address to get the token from, and then to upload the file.

usr<-"username"
pw<-"passwood"
url <- "https:/routurl/api/"
Token='Token'
UploadFile='UploadFile'


#Get Token
r <- httr::POST(url = paste0(url,Token), 
            body = list(
              UserName = usr,
              Password = pw,
              grant_type = "password"
            ), verbose())

tkn=jsonlite::prettify(httr::content(r, "text"))

This seems to work, as I can extract a token from the content.

> tkn
{
"result": {
    "token": "eyJhbGciOiJIUzFAKEIsInR5cCI6IkpCJ9.eyJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA1LzA1L2lkZW50aXR5L2NsYWltcy9uYW1lIjoiZ3JphzZSIsImp0aSI6IjUwNmIwN2MyLTTHISISFAKEIwMDUvMDUvaWRlbnRpdHkvY2xhaW1zL2VIVECHANGEDTHINGScyI6ImVtaWx5dGdyaWZmaXRoc0BiaW9zLmF1LmRrIiwiZXhwIjoxNTk4NzEwMTU3LCJpc3MiOiJ2bXNhcHAiLCJhdWQiOiJ2bXN1c2VycyJ9.z8sr-HT21u1bN7qCEXAMPLEONLY-TKAluO3k",
    "expiration": "29 August 2020 16:09:17"
},
"id": 2,
"exception": null,
"status": 5,
"isCanceled": false,
"isCompleted": true,
"isCompletedSuccessfully": true,
"creationOptions": 0,
"asyncState": null,
"isFaulted": false
}
 #re-formatting
 tkn=jsonlite::fromJSON(content(r, "text"), simplifyVector = FALSE)

So, this all seems ok, however, if I try to double check this on the JSON DeCoder, my correct web information comes up in the payload, but at the bottom it claims it is an invalid signature.

Also, the auth_token variable is NULL in the request, and that doesn't seem right.

> r$request$auth_token
 NULL

However, I can't test this because I cannot, for the life of me, figure out how to use this JWT to POST a file to the rooturl/UploadFile. Every document I look at that goes over how to POST to an API does not include how to include your JWT in the POST, or at least it isn't very clear. Is it in the header? Is it like this?

 r2=POST(url=paste0(url,UploadFile), body = list(y = upload_file('O:/Igoturfilerighthere.h5')),
         add_headers('Authorization' = paste("Bearer", tkn$result$token, sep = " ")), encode = "json", verbose())

Am I setting the headers incorrectly?

 r3=POST(url=paste0(url,UploadFile), body = list(y = upload_file('O:/Igoturfilerighthere.h5')),
     httr::add_headers("x-auth-token"=tkn$result$token), verbose())

For the r3 request I get a 401 error, which makes me think that I am on the correct path and that I am entering my token information incorrectly. If anyone could help guide me on the next step, I'd appreciate it. I just don't know where else to place that information.

Cheers, etg

UPDATE:

If, in the initial request, I add 'encode = "json"', it throws a 400 Bad Request Error. This is how the website I am trying to upload to writes its own code. I've double checked my username and password, and they are correct.

r <- httr::POST(url = paste0(url,Token), 
             body = list(
               UserName = usr,
               Password = pw,
               grant_type = "password"
             ),encode = "json", verbose())
HTTP/1.1 400 Bad Request
Transfer-Encoding: chunked
Content-Type: application/problem+json; charset=utf-8
Server: Microsoft-IIS/10.0
Strict-Transport-Security: max-age=2592000
X-Powered-By: ASP.NET

Answer 1

So, I reached out to the org behind the API I was trying to access, and there few a few problems with my JWT request. This is the correct code:

r <- httr::POST(paste0(url,Token), 
            body = list(UserName = usr, password = pw),
            encode = "form", verbose())

The big difference is 'grant_type' is removed and 'encode="form"', as I was trying to log in via a form on their site. With that difference, I was able to upload a file using the following:

r2=POST(url=paste0(url,UploadFile), body = list(fileToUpload = httr::upload_file('O:/IGotUrFileHere.h5')),
         httr::add_headers('Authorization' = paste("Bearer", tkn$result$token, sep = " ")), verbose())

Again, the verbose() function isn't necessary. It just helps you troubleshoot. Good luck!