Auth Token Setup

The auth-token script handles OAuth authentication against Authentik and returns a short-lived Bearer token for use with the StompingBear APIs. It is the same script for all APIs - only the configuration changes per API.

The script is provided as-is and works out of the box. If you want to build your own token management, it can also be used as a reference implementation of the Authentik public client OAuth flow.

Prerequisites

Contact [email protected] to receive:

Your Authentik username and password
The CLIENT_ID for each API you need access to
The auth-token script (or it can be installed via Ansible)

Installation

Option 1 - Via Ansible (recommended)

If you have access to the StompingBear Ansible playbooks, the script is installed automatically to /usr/local/bin/auth-token by the auth-token role.

Option 2 - Manual install

# Place the script in your PATH and make it executable
mv auth-token /usr/local/bin/auth-token
chmod +x /usr/local/bin/auth-token

Configuration

Create ~/.config/auth-token.env with your credentials. Include one CLIENT_ID line per API you need access to:

AUTHENTIK_URL=https://auth.stompingbear.com

# Add only the APIs you use
LEAGUE_TRAC_CLIENT_ID=<your-league-trac-client-id>
WEATHER_TRAC_PUBLIC_CLIENT_ID=<your-weather-trac-client-id>
RX_TRAC_PUBLIC_CLIENT_ID=<your-rx-trac-client-id>

The file is loaded automatically by the script — no need to export variables manually.

Usage

Run auth-token <api-name> where <api-name> matches the API:

# league-trac
auth-token league-trac

# weather-trac
auth-token weather-trac

# rx-trac
auth-token rx-trac

On first use (or when the token expires), the script will open your browser, redirect you to Authentik for login, then return the token to stdout.

How It Works

Uses the OAuth 2.0 Authorization Code flow (public client - no secret required)
Opens a local server on localhost:8000 to receive the OAuth callback
Tokens are cached at ~/.config/authentik-tokens.json (permissions set to 0600)
Tokens expire after 10 minutes; refresh tokens are used automatically
If refresh fails, a new browser login is triggered

Using Tokens with curl

# Inline - token generated fresh each call
curl -H "Authorization: Bearer $(auth-token league-trac)" \
  "https://api.league-trac.com/get_upcoming?days=7"

# Stored - reuse within a session
TOKEN=$(auth-token weather-trac)
curl -H "Authorization: Bearer $TOKEN" \
  "https://api.weather-trac.com/api/v1/weather/current?location=Delano,MN"

Using Tokens in Swagger UI

Each API's interactive docs are available at https://api.<api-name>.com/docs:

To authorize in Swagger UI:

Run auth-token <api-name> to get a token
Click Authorize in the top-right of the Swagger page
Paste the token in the Bearer field
Click Authorize, then Close

API-Specific Client ID Variables

API	Config variable	auth-token argument
league-trac	`LEAGUE_TRAC_CLIENT_ID`	`auth-token league-trac`
weather-trac	`WEATHER_TRAC_PUBLIC_CLIENT_ID`	`auth-token weather-trac`
rx-trac	`RX_TRAC_PUBLIC_CLIENT_ID`	`auth-token rx-trac`

Contact

Email: [email protected]