Authentication

Authentication

This page describes how to authenticate requests to the PEACH API.

Overview

The PEACH API requires authentication for all requests. PEACH uses a JWT-based stateless OIDC authentication approach. While all authenticated clients may perform read (GET) operations, only specific authorized clients may perform write (POST, PUT, DELETE) operations. If a request is made without a valid JWT, the API will refuse the request.

Onboarding

In order to access the PEACH API, you must first contact NRM.PermittingAndData@gov.bc.ca to request access. Once access is granted, you will be provided with the necessary credentials and instructions to authenticate your requests.

Authentication Approach

Requests to the PEACH API require a JSON Web Token (JWT) issued by the permittingexchange realm. The JWT must be added in an Authorization header with schema type Bearer.

When PEACH receives the request, it will validate the JWT (by calling the OIDC realm's token endpoint). The JWT is a reliable way of verifying the the user's identity on which the PEACH permission model is based upon.

Issuers

• Dev: https://dev.loginproxy.gov.bc.ca/auth/realms/permittingexchange
• Test: https://test.loginproxy.gov.bc.ca/auth/realms/permittingexchange
• Prod: https://loginproxy.gov.bc.ca/auth/realms/permittingexchange

Standards

• JWT: https://datatracker.ietf.org/doc/html/rfc7519
• OIDC: https://openid.net/specs/openid-connect-core-1_0.html