Sign in with Rhombus

import requests

headers = {
    "x-auth-scheme": "api-token",
    "x-auth-apikey": "YOUR_API_KEY",
    "Content-Type": "application/json",
}

response = requests.post(
    "https://api2.rhombussystems.com/api/oauth/submitApplication",
    headers=headers,
    json={
        "name": "Acme Console",
        "description": "Acme internal dashboard for Rhombus operators",
        "contactEmail": "engineering@acme.example",
        "redirectUri": "https://acme.example/oauth/callback",
    },
)

data = response.json()
print("clientId:    ", data["clientId"])
print("clientSecret:", data["clientSecret"])  # store securely — not retrievable later

const response = await fetch(
  "https://api2.rhombussystems.com/api/oauth/submitApplication",
  {
    method: "POST",
    headers: {
      "x-auth-scheme": "api-token",
      "x-auth-apikey": "YOUR_API_KEY",
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      name: "Acme Console",
      description: "Acme internal dashboard for Rhombus operators",
      contactEmail: "engineering@acme.example",
      redirectUri: "https://acme.example/oauth/callback",
    }),
  }
);

const { clientId, clientSecret } = await response.json();
console.log("clientId:    ", clientId);
await saveToSecretsManager("rhombus-oauth-client-secret", clientSecret); // shown only once; never log it

package main

import (
    "bytes"
    "encoding/json"
    "fmt"
    "net/http"
)

func main() {
    body, _ := json.Marshal(map[string]string{
        "name":         "Acme Console",
        "description":  "Acme internal dashboard for Rhombus operators",
        "contactEmail": "engineering@acme.example",
        "redirectUri":  "https://acme.example/oauth/callback",
    })

    req, _ := http.NewRequest("POST",
        "https://api2.rhombussystems.com/api/oauth/submitApplication",
        bytes.NewReader(body))
    req.Header.Set("x-auth-scheme", "api-token")
    req.Header.Set("x-auth-apikey", "YOUR_API_KEY")
    req.Header.Set("Content-Type", "application/json")

    resp, _ := http.DefaultClient.Do(req)
    defer resp.Body.Close()

    var result struct {
        ClientID     string `json:"clientId"`
        ClientSecret string `json:"clientSecret"`
    }
    json.NewDecoder(resp.Body).Decode(&result)
    fmt.Println("clientId:    ", result.ClientID)
    fmt.Println("clientSecret:", result.ClientSecret) // store securely
}

import base64
import hashlib
import secrets
from urllib.parse import urlencode

def new_pkce_pair():
    verifier = secrets.token_urlsafe(64)  # 86 chars after base64
    digest = hashlib.sha256(verifier.encode("ascii")).digest()
    challenge = base64.urlsafe_b64encode(digest).rstrip(b"=").decode("ascii")
    return verifier, challenge

client_id    = "PJjjlcKAQPCzIcaeprzEVg"
redirect_uri = "https://acme.example/oauth/callback"

code_verifier, code_challenge = new_pkce_pair()
state = secrets.token_urlsafe(32)

# Save code_verifier + state in the user's session before redirecting.

params = {
    "client_id":             client_id,
    "redirect_uri":          redirect_uri,
    "response_type":         "code",
    "scope":                 "read write physical",
    "state":                 state,
    "code_challenge":        code_challenge,
    "code_challenge_method": "S256",
}
authorize_url = f"https://console.rhombussystems.com/oauth/authorize?{urlencode(params)}"
print(authorize_url)

import crypto from "node:crypto";

function newPkcePair() {
  const verifier = crypto.randomBytes(64).toString("base64url");
  const challenge = crypto
    .createHash("sha256")
    .update(verifier)
    .digest("base64url");
  return { verifier, challenge };
}

const clientId    = "PJjjlcKAQPCzIcaeprzEVg";
const redirectUri = "https://acme.example/oauth/callback";

const { verifier: codeVerifier, challenge: codeChallenge } = newPkcePair();
const state = crypto.randomBytes(32).toString("base64url");

// Save codeVerifier + state in the user's session before redirecting.

const params = new URLSearchParams({
  client_id: clientId,
  redirect_uri: redirectUri,
  response_type: "code",
  scope: "read write physical",
  state,
  code_challenge: codeChallenge,
  code_challenge_method: "S256",
});
const authorizeUrl = `https://console.rhombussystems.com/oauth/authorize?${params}`;
console.log(authorizeUrl);

package main

import (
    "crypto/rand"
    "crypto/sha256"
    "encoding/base64"
    "fmt"
    "net/url"
)

func newPkcePair() (verifier, challenge string) {
    b := make([]byte, 64)
    rand.Read(b)
    verifier = base64.RawURLEncoding.EncodeToString(b)
    sum := sha256.Sum256([]byte(verifier))
    challenge = base64.RawURLEncoding.EncodeToString(sum[:])
    return
}

func randomState() string {
    b := make([]byte, 32)
    rand.Read(b)
    return base64.RawURLEncoding.EncodeToString(b)
}

func main() {
    clientID    := "PJjjlcKAQPCzIcaeprzEVg"
    redirectURI := "https://acme.example/oauth/callback"

    codeVerifier, codeChallenge := newPkcePair()
    state := randomState()

    // Save codeVerifier + state in the user's session before redirecting.

    params := url.Values{
        "client_id":             {clientID},
        "redirect_uri":          {redirectURI},
        "response_type":         {"code"},
        "scope":                 {"read write physical"},
        "state":                 {state},
        "code_challenge":        {codeChallenge},
        "code_challenge_method": {"S256"},
    }
    fmt.Println("https://console.rhombussystems.com/oauth/authorize?" + params.Encode())
}

from flask import Flask, request, session, abort

app = Flask(__name__)

@app.route("/oauth/callback")
def callback():
    if request.args.get("error"):
        return f"Login failed: {request.args['error_description']}", 400

    code  = request.args.get("code")
    state = request.args.get("state")

    if state != session.pop("oauth_state", None):
        abort(400, "state mismatch")

    code_verifier = session.pop("oauth_verifier", None)
    # Proceed to Step 4 — exchange `code` for an access token.
    ...

import express from "express";
const app = express();

app.get("/oauth/callback", (req, res) => {
  const { code, state, error, error_description } = req.query;

  if (error) return res.status(400).send(`Login failed: ${error_description}`);
  if (state !== req.session.oauthState) return res.status(400).send("state mismatch");

  const codeVerifier = req.session.oauthVerifier;
  // Proceed to Step 4 — exchange `code` for an access token.
});

// HTTP handler for your redirect URI.
func handleCallback(w http.ResponseWriter, r *http.Request) {
    q := r.URL.Query()

    if errMsg := q.Get("error"); errMsg != "" {
        http.Error(w, "login failed: "+q.Get("error_description"), 400)
        return
    }

    code := q.Get("code")
    state := q.Get("state")

    if state != session.State(r) {
        http.Error(w, "state mismatch", 400)
        return
    }

    codeVerifier := session.Verifier(r)
    // Proceed to Step 4 — exchange `code` for an access token.
    _, _ = code, codeVerifier
}

import requests

token_response = requests.post(
    "https://auth-web.rhombussystems.com/oauth/token",
    headers={"Content-Type": "application/x-www-form-urlencoded"},
    data={
        "grant_type":    "authorization_code",
        "code":          code,
        "redirect_uri":  redirect_uri,
        "code_verifier": code_verifier,
        "client_id":     client_id,
        "client_secret": client_secret,
    },
)
token_response.raise_for_status()
tokens = token_response.json()

access_token  = tokens["access_token"]
refresh_token = tokens["refresh_token"]
expires_in_s  = tokens["expires_in"]
granted_scope = tokens["scope"]

const tokenResponse = await fetch("https://auth-web.rhombussystems.com/oauth/token", {
  method: "POST",
  headers: { "Content-Type": "application/x-www-form-urlencoded" },
  body: new URLSearchParams({
    grant_type: "authorization_code",
    code,
    redirect_uri: redirectUri,
    code_verifier: codeVerifier,
    client_id: clientId,
    client_secret: clientSecret,
  }),
});

if (!tokenResponse.ok) {
  throw new Error(`Token exchange failed: ${await tokenResponse.text()}`);
}

const {
  access_token: accessToken,
  refresh_token: refreshToken,
  expires_in: expiresIn,
  scope: grantedScope,
} = await tokenResponse.json();

form := url.Values{
    "grant_type":    {"authorization_code"},
    "code":          {code},
    "redirect_uri":  {redirectURI},
    "code_verifier": {codeVerifier},
    "client_id":     {clientID},
    "client_secret": {clientSecret},
}

req, _ := http.NewRequest("POST",
    "https://auth-web.rhombussystems.com/oauth/token",
    strings.NewReader(form.Encode()))
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")

resp, err := http.DefaultClient.Do(req)
if err != nil || resp.StatusCode != 200 {
    return fmt.Errorf("token exchange failed")
}
defer resp.Body.Close()

var tokens struct {
    AccessToken  string `json:"access_token"`
    RefreshToken string `json:"refresh_token"`
    TokenType    string `json:"token_type"`
    ExpiresIn    int    `json:"expires_in"`
    Scope        string `json:"scope"`
}
json.NewDecoder(resp.Body).Decode(&tokens)

import requests

headers = {
    "Authorization": f"Bearer {access_token}",
    "Content-Type": "application/json",
}

response = requests.post(
    "https://api2.rhombussystems.com/api/user/getUsersInOrg",
    headers=headers,
    json={},
)

users = response.json().get("users", [])
for user in users:
    print(user.get("email"), "—", user.get("name"))

const response = await fetch(
  "https://api2.rhombussystems.com/api/user/getUsersInOrg",
  {
    method: "POST",
    headers: {
      Authorization: `Bearer ${accessToken}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({}),
  }
);

const { users = [] } = await response.json();
for (const user of users) {
  console.log(`${user.email} — ${user.name}`);
}

req, _ := http.NewRequest("POST",
    "https://api2.rhombussystems.com/api/user/getUsersInOrg",
    strings.NewReader("{}"))
req.Header.Set("Authorization", "Bearer "+accessToken)
req.Header.Set("Content-Type", "application/json")

resp, _ := http.DefaultClient.Do(req)
defer resp.Body.Close()
// ... decode response

import requests

response = requests.post(
    "https://api2.rhombussystems.com/api/integrations/org/submitApiTokenApplication",
    headers={
        "Authorization": f"Bearer {access_token}",
        "Content-Type": "application/json",
    },
    json={
        "displayName": "Acme Console — background worker",
        "permissionGroupUuid": role_uuid,
        "authType": "API_TOKEN",
    },
)

data = response.json()
if data.get("error"):
    raise RuntimeError(data.get("errorMsg"))
api_key = data["apiKey"]  # store this securely — treat it like a password

const response = await fetch(
  "https://api2.rhombussystems.com/api/integrations/org/submitApiTokenApplication",
  {
    method: "POST",
    headers: {
      Authorization: `Bearer ${accessToken}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      displayName: "Acme Console — background worker",
      permissionGroupUuid: roleUuid,
      authType: "API_TOKEN",
    }),
  }
);

const data = await response.json();
if (data.error) throw new Error(data.errorMsg);
const { apiKey } = data; // store apiKey securely — treat it like a password

body, _ := json.Marshal(map[string]string{
    "displayName":         "Acme Console — background worker",
    "permissionGroupUuid": roleUuid,
    "authType":            "API_TOKEN",
})

req, _ := http.NewRequest("POST",
    "https://api2.rhombussystems.com/api/integrations/org/submitApiTokenApplication",
    bytes.NewReader(body))
req.Header.Set("Authorization", "Bearer "+accessToken)
req.Header.Set("Content-Type", "application/json")
// ... execute and decode; store apiKey securely.