# Authentication

## Prerequisites

Before you start integrating the APIs, ensure you have the account **API Keys**. The required unique API Key and Secret Key can be obtained from your Fynd Engage dashboard under **Settings** > **API Keys**.

Engage API Keys
For more information about your organization's API keys, please refer to our [API Keys](/engage/docs/guides/api-keys) documentation

## Authentication Overview

The Fynd Engage API Suite uses HTTP Basic Authentication to secure API requests. The `setCommonHeader` method initializes and sets the required headers for secure communication with the API.

**Required Headers:**

- **Authorization Header**: Contains Base64-encoded credentials (`api_key:api_secret`)
- **Content-Type Header**: Specifies the request payload format (typically `application/json`)


Below is an example implementation of the authentication strategy:


```javascript
class EngageStrategy {
    constructor(config, user) {
        this.config = config;
        this.headers = {};
        this.setCommonHeader();
    }

    // Method to set common headers
    setCommonHeader() {
        let { api_key, api_secret } = this.config;
        const credentials = `${api_key}:${api_secret}`;
        const encodedCredentials = Buffer.from(credentials).toString("base64");
        
        this.headers = {
            Authorization: `Basic ${encodedCredentials}`,
            "Content-Type": "application/json",
        };
    }

    // Method to send the API request
    async sendRequest(endpoint, payload, queryParams) {
        const query = new URLSearchParams(queryParams).toString();
        const url = query ? `${endpoint}?${query}` : endpoint;
        
        const response = await fetch(url, {
            method: "POST",
            headers: this.headers,
            body: JSON.stringify(payload),
        });
        
        const data = await response.json();
        return data;
    }
}
```

## Authentication Process

**Step 1: Credential Concatenation**

The API key and secret are combined with a colon separator:


```javascript
const credentials = `${api_key}:${api_secret}`;
```

Example: If your API key is `myApiKey` and secret is `myApiSecret`, the result would be:


```
myApiKey:myApiSecret
```

**Step 2: Base64 Encoding**

The concatenated string is encoded in Base64 format using Node.js's `Buffer` class:


```javascript
const encodedCredentials = Buffer.from(credentials).toString("base64");
```

This ensures credentials are represented in a secure and standardized format.

**Step 3: Authorization Header Construction**

The final Authorization header is constructed in the format:


```
Authorization: Basic <Base64_encoded_credentials>
```

## User Identification

### Required Query Parameters

For every API call to succeed, it is *mandatory* to include either `phoneNumber` or `userIdentifier` as a query parameter. These parameters identify the user making the request.

Example:


```javascript
const queryParams = {
    phoneNumber: "9999999990", // OR
    userIdentifier: "12345",
};

const response = await engageStrategy.sendRequest(
    "https://api.engage.fynd.com/service/engage/platform/v1/order/discount",
    payload,
    queryParams
);
```

## Making an Engage API Call

**API Headers**

The headers (`Authorization` and `Content-Type`) are sent with every API request. The API server processes these headers as follows:

1. **Extracts** the `Authorization` header
2. **Decodes** the Base64 string to retrieve the API key and secret
3. **Validates** the credentials against the system records


**Request Format**

The `fetch` function sends the request with the following structure:


```javascript
const response = await fetch(endpoint, {
    method: "POST",
    headers: this.headers,
    body: JSON.stringify(payload),
});
```

**Components**:

- `endpoint`: The API endpoint URL
- `headers`: Includes the `Authorization` and `Content-Type` headers
- `body`: Contains the request payload serialized as a JSON string