I have a backend service

foo

using the prisma service. Right now

foo

use a token generated using

prisma token

. Since the token expires I need to renew the token. I consider setting up a service renewing the token every x minutes. I that the way to do it or are there other way?

No this is not needed. How is your backend talking to Prisma? Through Prisma client?

yes. using post request with Authorization header, bearer etc. I also have a file handler service written using koa which has the prisma client in context including the prisma_secret; works without token. However, the service in question is written in python so there I use the token?

The easiest way should be to import a python library for JWT into your project and just create a token yourself inside your backend.

ok. thanks. services need to know the prisma_secret I suppose 🙂

yes they need to know that. I will try to find an example.

thanks. I dig in the mean time as well. Is it correct that prisma client use https://www.npmjs.com/package/jsonwebtoken using hs256 algorithm?

yes. here’s what the go client does: https://github.com/prisma/prisma-client-lib-go/commit/68a1f9908416aebb5bbb0bc3cdec3321d74cb7af#diff-1861a0c40780efdec0f4e6e2e19b3d44R53

this works:

@marcus related question to see if I’m doing this correctly, I just have an environment variable with “prisma secret” in my backend that passes it to Prisma Bindings. Service config has

secret: ${env:PRISMA_SECRET}

(same variable). Apart from that, in the Service Docker I specify

managementApiSecret

with the same value. Does this sound right? However, I haven’t used

prisma token

command at all. This secret was generated with

openssl rand

or similar 🤔

@Fran Dios: 1. Passing the secret from the service config to Prisma binding is correct. You don’t need to call

prisma token

in this case because the bindings are already doing that for you internally. @yolen had to do that because we don’t have an official client for Python yet. 2. You can use the same secret for

managementApiSecret

if you want to. However i would recommend to use something different. This secret protects your management API which is called by

prisma deploy

. You don’t need to put that secret somewhere else. It is automatically picked up by the Prisma CLI.

It is automatically picked up by the Prisma CLI

I see! That’s the part that confused me, I thought it had to be the same because otherwise CLI wouldn’t know. Thanks a lot @marcus

@Fran Dios Maybe this FAW helps to understand the differences of the service secret and management API secret a bit better: https://www.prisma.io/docs/-fq01/ 🙂

@nikolasburk I see that it doesn’t work for 1.14, which is the version where I read the docs fully 😅. Works for 1.24, thanks!

smallish thing. remember to decode:

@classmethod
    def _get_prisma_token(cls):
        PRISMA_SECRET = os.environ['PRISMA_SECRET']
        prisma_token = jwt.encode({}, PRISMA_SECRET, algorithm='HS256').decode('utf-8')
        
        return prisma_token