Skip to main content

Dynamic Token Authentication

Welcome to the Dynamic Token Authentication documentation!

Most modern APIs require some form of authentication, typically a JWT or Bearer token obtained from a /login endpoint. Because Rumour uses a deterministic execution graph, it is trivial to create a workflow where a login request runs first, extracts the token, and passes it to all subsequent requests.

The Workflow Setup​

Let's build a simple 2-step workflow.

1. The Environment​

Create a workspace.env.toml to hold the credentials securely.

base_url = "https://api.swahira.io/v1"
admin_email = "admin@swahira.io"
admin_pass = "secure123"

2. The Login Node​

Create 1_login.toml. This request sends the credentials and uses the [extract] block to pull the access_token from the JSON response and store it in global memory.

name = "Authenticate Admin"

[request]
method = "POST"
url = "{{base_url}}/auth/login"

[body]
type = "json"
raw = '{"email": "{{admin_email}}", "password": "{{admin_pass}}"}'

[extract]
# This pulls the value of 'token' from the response JSON body
auth_token = "json.token"

[assert]
status = 200

3. The Protected Node​

Create 2_get_profile.toml. This request explicitly lists 1_login.toml as a dependency, ensuring Rumour waits for the login to succeed. It then injects {{auth_token}} into the Authorization header.

name = "Fetch Secure Profile"

[dependencies]
# We require the auth_token exported by the login node
"1_login.toml" = "auth_token"

[request]
method = "GET"
url = "{{base_url}}/users/me"

[headers]
Authorization = "Bearer {{auth_token}}"

[assert]
status = 200

Execution & Output Trace​

When you run this directory, Rumour analyzes the [dependencies] block, builds a DAG, and correctly runs the login before the profile request.

rumour run ./auth_flow/ -v

The Trace​

  POST https://api.swahira.io/v1/auth/login
  ✓ SUCCESS: ./auth_flow/1_login.toml (142ms)
  GET https://api.swahira.io/v1/users/me
  ✓ SUCCESS: ./auth_flow/2_profile.toml (85ms)

╭──────────────────────────────────────────────────────────────────────────╮
│ RUMOUR EXECUTION REPORT                                                  │
├──────────────────────────────────────────────────────────────────────────┤
│ Total Requests:      2                                                   │
│ Successful:          2                                                   │
│ Failed:              0                                                   │
│ Skipped:             0                                                   │
│ Success Rate:        100.0%                                              │
│ Total Time:          227ms                                               │
╰──────────────────────────────────────────────────────────────────────────╯

✓ Successful Requests:
  - ./auth_flow/1_login.toml     [200] [142ms]
  - ./auth_flow/2_profile.toml   [200] [85ms]

Validating the Extraction​

If you want to verify that the token was extracted correctly without looking at the raw terminal trace, you can run the suite with the --vars diagnostic flag.

rumour run ./auth_flow/ --vars

In the output, you will see the variable stored in memory at runtime:

RUNTIME VARIABLES:
  auth_token = eyJhbGciOiJIUzI1NiIsInR5cCI6...
  base_url = https://api.swahira.io/v1