Search code examples
oauthautodesk-forgeserverless

User can access the model with only access token in Forge Viewer(Serverless)


I was following forge tutorials to embed the forge viewer in an html page. I ended up at this forge-made page, link: https://github.com/Autodesk-Forge/learn.forge.viewmodels/tree/gh-pages. I understand that I need Client ID and Client Secret to get the Access token. Then I can view the OSS bucket/view the model.Now I need to modify the code a little bit so that Client ID and Client secret will be put on the env. I will share Access Token to my customer. Once they enter the access token then can view the model and can use Extensions also. Could someone help me to get the code.

I just don't want to share client id and Client secret as per the youtube link https://www.youtube.com/watch?v=dekLGw6PndI . The rest things will be same as per the youtube link.

Thank you in advance.


Solution

  • Please note that even without sharing the client Id and client Secret, with the token, the user will be able to perform all the actions granted by the scopes for one hour.

    That said, here's one sample where we limit the public token to viewables:read scope, so the user can only access derivatives for a specific model that needs to be shared. In this case, we're using AWS Lambda with API Gateway to retrieve the token here.

    This sample is using a function like this one to obtain the token.