View source for Joomla Api Specification

== Authentication == <!--T:2-->
</translate>
<translate><!--T:3--> There is a group of api-authentication plugins to allow custom authentication into Joomla Core which can have any implementation. We have chosen not to implement a full blown oAuth 2 specification into the core. However it is intended that this can be achieved with the plugin group (and by disabling the ''API Authentication - Joomla Token'' plugin and the ''User - Joomla Token'' plugin). The built-in authentication uses a Bearer Token implementation.</translate> 

<translate><!--T:23--> The HMAC is the main security feature of our Bearer token implementation. This is the [https://tools.ietf.org/html/rfc2104 RFC 2104] HMAC of the seed data using Joomla's site secret (the ''$secret'' in the ''configuration.php'' file) as the key. The base64-encoded seed is stored in the database in the user profile table.</translate>

<translate><!--T:24--> The token itself is the base64-encoded representation of a string algorithm:user_id:hmac. The algorithm tells us which cryptographic hash function was used to generate the HMAC. Per the security considerations of [https://tools.ietf.org/html/rfc6151 RFC 6151] we forbid the use of the less secure cryptographic hash functions. In fact, the current implementation only allows SHA-256 and SHA-512 with SHA-256 being the (hardcoded) method used to generate the token displayed to the user. (SHA-512 is added for forward compatibility).</translate>

<translate><!--T:25--> For security and privacy reasons, users can only view their own token even if they are Super Users. Users with ''com_users'' edit privileges can also disable, enable or reset another user's token (if they believe the token has been compromised) '''but''' they still cannot view it. Users can also choose to disable their own API Key.</translate>

<translate><!--T:26--> There is also a legacy basic authentication plugin for simple local development. However this is likely to be removed before the release of Joomla 4.0.0 stable.</translate>

<translate>