import requests
import base64

client_id = 'sec_abcdefgh12345678'
client_secret = 'frs_secret_XyZ123...ABC789'
frontier_url = 'http://localhost:7400'

# Encode credentials
credentials = base64.b64encode(
    f'{client_id}:{client_secret}'.encode()
).decode()

# Request access token
def get_access_token():
    response = requests.post(
        f'{frontier_url}/v1beta1/auth/token',
        headers={
            'Authorization': f'Basic {credentials}',
            'Content-Type': 'application/x-www-form-urlencoded'
        },
        data={'grant_type': 'client_credentials'}
    )
    return response.json()['access_token']

# Use access token
def make_api_call():
    token = get_access_token()
    
    response = requests.get(
        f'{frontier_url}/v1beta1/users/self',
        headers={'Authorization': f'Bearer {token}'}
    )
    
    print(response.json())

make_api_call()

package main

import (
    "context"
    "encoding/base64"
    "fmt"
    "net/http"
    "net/url"
    "strings"
)

const (
    clientID     = "sec_abcdefgh12345678"
    clientSecret = "frs_secret_XyZ123...ABC789"
    frontierURL  = "http://localhost:7400"
)

type TokenResponse struct {
    AccessToken string `json:"access_token"`
    TokenType   string `json:"token_type"`
    ExpiresIn   int    `json:"expires_in"`
}

func getAccessToken() (string, error) {
    // Encode credentials
    credentials := base64.StdEncoding.EncodeToString(
        []byte(clientID + ":" + clientSecret),
    )

    // Request access token
    data := url.Values{}
    data.Set("grant_type", "client_credentials")

    req, _ := http.NewRequest(
        "POST",
        frontierURL+"/v1beta1/auth/token",
        strings.NewReader(data.Encode()),
    )
    req.Header.Set("Authorization", "Basic "+credentials)
    req.Header.Set("Content-Type", "application/x-www-form-urlencoded")

    client := &http.Client{}
    resp, err := client.Do(req)
    if err != nil {
        return "", err
    }
    defer resp.Body.Close()

    var tokenResp TokenResponse
    json.NewDecoder(resp.Body).Decode(&tokenResp)
    
    return tokenResp.AccessToken, nil
}

func main() {
    token, err := getAccessToken()
    if err != nil {
        panic(err)
    }
    
    fmt.Println("Access Token:", token)
}

const jwt = require('jsonwebtoken');
const fs = require('fs');
const axios = require('axios');

class ServiceUserAuth {
  constructor(privateKeyPath, kid, principalId, frontierUrl) {
    this.privateKey = fs.readFileSync(privateKeyPath);
    this.kid = kid;
    this.principalId = principalId;
    this.frontierUrl = frontierUrl;
  }

  // Generate signed JWT
  generateJWT() {
    return jwt.sign(
      {
        sub: this.principalId,
        iss: 'my-application',
        aud: this.frontierUrl,
      },
      this.privateKey,
      {
        algorithm: 'RS256',
        keyid: this.kid,
        expiresIn: '12h'
      }
    );
  }

  // Exchange JWT for access token
  async getAccessToken() {
    const signedJWT = this.generateJWT();
    
    const response = await axios.post(
      `${this.frontierUrl}/v1beta1/auth/token`,
      'grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer',
      {
        headers: {
          'Authorization': `Bearer ${signedJWT}`,
          'Content-Type': 'application/x-www-form-urlencoded'
        }
      }
    );
    
    return response.data.access_token;
  }

  // Make authenticated API call
  async makeRequest(endpoint) {
    const token = await this.getAccessToken();
    
    const response = await axios.get(
      `${this.frontierUrl}${endpoint}`,
      {
        headers: {
          'Authorization': `Bearer ${token}`
        }
      }
    );
    
    return response.data;
  }
}

// Usage
const auth = new ServiceUserAuth(
  './private-key.pem',
  'key_c029a17d-0bad-472c-b335-ed58ba370d84',
  'su_1234567890',
  'http://localhost:7400'
);

auth.makeRequest('/v1beta1/organizations')
  .then(data => console.log(data))
  .catch(err => console.error(err));