Autenticación

curl -X POST "https://api.notmeta.com/v1/auth/tokens" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Mi aplicación",
    "permissions": ["messages:read", "messages:write"],
    "expires_at": "2024-12-31T23:59:59Z"
  }'

curl -X GET "https://api.notmeta.com/v1/conversations" \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

const response = await fetch('https://api.notmeta.com/v1/conversations', {
  headers: {
    'Authorization': `Bearer ${process.env.NOTMETA_API_TOKEN}`,
    'Content-Type': 'application/json'
  }
});

import requests

headers = {
    'Authorization': f'Bearer {api_token}',
    'Content-Type': 'application/json'
}

response = requests.get('https://api.notmeta.com/v1/conversations', headers=headers)

$headers = [
    'Authorization: Bearer ' . $api_token,
    'Content-Type: application/json'
];

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'https://api.notmeta.com/v1/conversations');
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
$response = curl_exec($ch);

curl -X GET "https://api.notmeta.com/v1/auth/verify" \
  -H "Authorization: Bearer TU_TOKEN"

{
  "valid": true,
  "token_type": "api",
  "permissions": ["conversations:read", "messages:write"],
  "expires_at": "2024-12-31T23:59:59Z",
  "created_at": "2024-01-01T00:00:00Z"
}

async function hasPermission(token, permission) {
  const response = await fetch('https://api.notmeta.com/v1/auth/verify', {
    headers: {
      'Authorization': `Bearer ${token}`
    }
  });
  
  const data = await response.json();
  return data.permissions.includes(permission);
}

// Uso
const canSendMessages = await hasPermission(token, 'messages:write');

function isTokenExpired(token) {
  try {
    const payload = JSON.parse(atob(token.split('.')[1]));
    return payload.exp * 1000 < Date.now();
  } catch (error) {
    return true;
  }
}

curl -X POST "https://api.notmeta.com/v1/auth/refresh" \
  -H "Authorization: Bearer TOKEN_ACTUAL" \
  -H "Content-Type: application/json"

const oauthUrl = `https://api.notmeta.com/oauth/authorize?` +
  `client_id=${CLIENT_ID}&` +
  `redirect_uri=${REDIRECT_URI}&` +
  `scope=${SCOPES}&` +
  `response_type=code&` +
  `state=${RANDOM_STATE}`;

// ❌ Incorrecto - Token en código
const token = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...';

// ✅ Correcto - Token en variables de entorno
const token = process.env.NOTMETA_API_TOKEN;

class TokenManager {
  constructor() {
    this.token = null;
    this.refreshToken = null;
    this.expiresAt = null;
  }
  
  async getValidToken() {
    if (!this.token || this.isExpired()) {
      await this.refreshToken();
    }
    return this.token;
  }
  
  isExpired() {
    return this.expiresAt && Date.now() >= this.expiresAt;
  }
  
  async refreshToken() {
    // Implementar lógica de renovación
  }
}

async function makeAuthenticatedRequest(url, options = {}) {
  try {
    const response = await fetch(url, {
      ...options,
      headers: {
        ...options.headers,
        'Authorization': `Bearer ${await tokenManager.getValidToken()}`
      }
    });
    
    if (response.status === 401) {
      // Token inválido o expirado
      await tokenManager.refreshToken();
      // Reintentar con nuevo token
      return fetch(url, {
        ...options,
        headers: {
          ...options.headers,
          'Authorization': `Bearer ${await tokenManager.getValidToken()}`
        }
      });
    }
    
    return response;
  } catch (error) {
    console.error('Error de autenticación:', error);
    throw error;
  }
}