Challonge vs API Bearer Auth

The API Bearer Auth plugin enables authentication for the REST API by using JWT access an refresh tokens. After the user logs in, the access and refresh tokens are returned and can be used for the next requests. Issued tokens can be revoked from within the users admin screen. See below for the endpoints. Note that after activating this plugin, all REST API endpoints will need to be authenticated, unless the endpoint is whitelisted in the api_bearer_auth_unauthenticated_urls filter (see FAQ for how to use this filter). JWT Access tokens can be formatted as JWT tokens. For this to work, you first have to create a secret and add it to the wp-config.php file. If you don’t do this, access tokens will work also, but are just random strings. To create a random secret key, you can do for example: base64_encode(openssl_random_pseudo_bytes(64)); And then add the result to wp-config: define('API_BEARER_JWT_SECRET', 'mysecretkey'); If you have problems, you can verify your JWT tokens at: https://jwt.io/ Revoke tokens This plugin adds a column to the users table in de admin where you can see when a token expires. You can also revoke tokens by selection the “Revoke API tokens” from the bulk actions select box. API endpoints Note that all endpoints expect JSON in the POST body. Login Endpoint: POST /api-bearer-auth/v1/login Request body: Note: client_name is optional. But if you use it, make sure to use it as well for the refresh call! {"username": "my_username", "password": "my_password", "client_name": "my_app"} Response: { "wp_user": { "data": { "ID": 1, "user_login": "your_user_login", // other default WordPress user fields } }, "access_token": "your_access_token", "expires_in": 86400, // number of seconds "refresh_token": "your_refresh_token" } Make sure to save the access and refresh token! Refresh access token Endpoint: POST /api-bearer-auth/v1/tokens/refresh Request body: Note: client_name is optional. But if you did use it for the login call, make sure to use it here as well! {"token": "your_refresh_token", "client_name": "my_app"} Response success: { "access_token": "your_new_access_token", "expires_in": 86400 } Response when sending a wrong refresh token is a 401: { "code": "api_api_bearer_auth_error_invalid_token", "message": "Invalid token.", "data": { "status": 401 } } Do a request After you have the access token, you can make requests to authenticated endpoints with an Authorization header like this: Authorization: Bearer Note that Apache sometimes strips out the Authorization header. If this is the case, make sure to add this to the .htaccess file: RewriteCond %{HTTP:Authorization} ^(.*) # Don't know why, but some need the line below instead of the RewriteRule line # SetEnvIf Authorization .+ HTTP_AUTHORIZATION=$0 RewriteRule ^(.*) - [E=HTTP_AUTHORIZATION:%1] If you are not logged in or you send an invalid access token, you get a 401 response: { "code": "api_bearer_auth_not_logged_in", "message": "You are not logged in.", "data": { "status": 401 } } Important update Update immediately if you’re using a version below 20200807. Before this version all access tokens were updated when calling the refresh callback. If you are affected by this the fastest solution is to execute this query: update wp_user_tokens set access_token_valid = NOW(); This will invalidate all access tokens. This means that all users need to refresh their access token and will get a new access token and a unique one this time. A big thank to @harchvertelol for reporting this and suggesting the fix as well!

Do you use Challonge for your gaming or sport events? The Challonge plugin integrates your Challonge tournaments into your WordPress website so your users may easily see recent tournaments, their progress, and even sign up and participate. Features Adaptive caching and background refresh allows your pages to load a lot faster than before! – New in 1.1.6! Only registered users may sign up to your tournaments. Likewise, your users may forfeit a tournament after signing up, but only before it begins. Participating users may report their own scores. Includes role capabilities. You will need a role management plugin to change who has these capabilities. Custom participant name templating. Languages English Spanish (68%) – Thanks to Andrew Kurtis from WebHostingHub for translating! Requirements In order to use the API, you will need cURL. Most PHP installations include cURL. Latest Information Keep up to date with upcoming release information on my website: https://zavaboy.org/challonge-wordpress-plugin/ Getting Started Before you start using this plugin, here’s what you’ll need: A Challonge.com account. Registration is free. A valid Developer API Key so the Challonge plugin can talk with your Challonge.com account. Once you have the Challonge plugin installed and activated on your website, you will need to enter your Challonge.com API key in ‘Settings’ > ‘Challonge’. Once you have done that, you have unlocked the full power of this nice plugin. Shortcode You may use a shortcode in posts and pages to display a tournament or list out tournaments. [challonge] – This will list out all tournament brackets in your account, excluding all organizations. [challonge url="w4la9fs6"] – This will embed a tournament bracket. This may be any Challonge bracket, not just your own. [challonge subdomain="my_sub"] – This will list out all tournament brackets in the ‘my_sub’ organization. (eg: my_sub.challonge.com) [challonge url="w4la9fs6" theme="2" show_final_results="1" width="90%" height="600px"] – This is just a more customized version of the first shortcode. If you have a tournament bracket within an organization, you will have to use the subdomain attribute along with the url attribute, like so: [challonge url="w4la9fs6" subdomain="my_sub"] Here’s all the shortcode attributes available to you: url – The URL to a tournament. subdomain – The subdomain of the tournament URL or if no tournament URL is provided, the listing will be tournaments within the specified subdomain. theme – The theme ID you would like to use. multiplier – Scales the entire bracket. match_width_multiplier – Scales the width allotted for names. show_final_results – Display the final results above your bracket. show_standings – For round robin and Swiss tournaments, you can opt to show a table of the standings below your bracket. width – The width of the embedded tournament bracket. height – The height of the embedded tournament bracket. limit – Limit the number of returned results for tournament listings. allowusers / denyusers / allowroles / denyroles – A comma separated list of users or roles you would like to specifically allow or deny from viewing the tournament bracket or tournament listings. statuses / excludestatuses – A comma separated list of tournament statuses you would like to specifically show or hide from the tournament listings. All statuses: “Pending,Checking In,Checked In,Underway,Awaiting Review,Complete” listparticipants – List participants currently in the tournament. (Must be used with url) – New in 1.1.6! Widget To allow your users to signup and report their own scores, just add the plugin widget. The widget has the following options: Title – The title of the widget, nothing special here. Defaults to ‘Challonge’. Subdomain – The subdomain to list your tournaments from. (Optional) Tournament Filter – Only tournament names that match this filter will be listed. (Optional) This may be a simple wildcard filter, for example My * Tournament will match ‘My Big Tournament’ but not ‘Your Big Tournament’. If you need a more robust filter, you may use Regular Expressions (PCRE) like so: /My \d+(st|nd|rd|th) Tournament/i will match ‘My 3rd tournament’ but not ‘My Third Tournament’ Status Filter – Only list tournaments with the selected statuses, unless none are selected. Max tournaments listed – The maximum number of tournaments that the widget will list. Defaults to 10. Integrating Challonge.com Tournaments Challonge.com tournaments may be easily setup to allow your WordPress users to signup and report scores. Here are a few things you should know when setting up your Challonge.com tournaments: Turning ‘Host a sign-up page’ on will allow your users to signup through the widget. In ‘Advanced Options’ > ‘Permissions’: Turning ‘Allow participants with Challonge accounts to report their own scores.’ on will allow your users to report their own scores through the widget. In ‘Advanced Options’ > ‘Permissions’: Turning ‘Exclude this event from search engines and the public browsable index.’ on will hide the tournament from the shortcode and widget tournament listings. Did You Know? If you run the same tournaments on multiple WordPress websites, your WordPress users will be tracked in your Challonge.com tournaments by their email address and login name, even if their display name differs. With this in mind, users may signup and report their score using either website. Also note, users who change their email address will lose access to any of their preexisting tournament signups. Good luck!