If a passwordless option was available too, i.e. email a TOTP code that is a nonce, and presentation of the TOTP would generate a JWT with the email address as the claim... then this would become my new login manager.
I'm presently using auth0 free plan. Which is nice, but passwordless lock (their JS library) is old, and their docs are not great as to how to update to their other lock library (I've concluded you can't stay passwordless with the main auth0 lock library).
Controlling non logged in user claims / access without having to have special "no token" caveats or endpoints (i.e. any user can have read access to an endpoint, but only if they have a token / have come via your website).
Is anything like this supported anywhere?
API keys kind of do the job, but they're basically deprecated through a lot of JWT providers, and you need to support two Auth systems if you're using JWT for logged in users.
Flow is:
* Arrive at website * Generate an access token without any user input (anon user with default read only privileges) * Use the same APIs as logged in users, with restricted access defined in the JWT / Auth provider.
The two sides of it, am I allowed to access this API, coupled with what can I do once accessed seem to be the basic use case for JWT.
I appreciate the response. My terminology is likely a bit off, it's been a while :)