API's authentication, nex box

[Ericsipad]

I would like to preface this question by stating I have worked with my dev team for 2 years and they have built some complicated things...but, we are not able to see in the docs what API will create a new email address and password....which seems like it would jump out at you. Then further, how to Authenticate the API is also not clear. maybe it is so obvious we cant see it...thank you for the direction.

[mdecimus]

Here is the endpoint to create accounts (principals):

https://stalw.art/docs/api/management/endpoints#create-principal

But yes, it needs to be documented better. In the meantime you can use the Webadmin to create a test account and see in the browser console the exact API call being used.

[Ericsipad]

Thank you for above, we are seeing the Account appear now but the passwords seems to not work as logging is rejected on new accounts. My developer is asking :

Can you please ask the documentation person from Stalwart about how we are encrypting password using scrypt according to this documentation https://stalw.art/docs/auth/authentication/password.

const salt = crypto.randomBytes(16).toString('hex');
const derivedKey = (await promisify(crypto.scrypt)(
createUserDto.password,
salt,
64,
)) as Buffer;

const hashedPassword = ${salt}:${derivedKey.toString('hex')};

And this is how what I am sending in the payload in create principal API.
secrets: [$scrypt${hashedPassword}],

[andreymal]

Stalwart (or, more precisely, the underlying password libraries) uses the PHC string format where possible

import crypto from 'crypto';
import { promisify } from 'util';

const password = 'correcthorsebatterystaple';
const salt = crypto.randomBytes(16);

const logN = 14; // The log₂ of the Scrypt parameter N
const blockSize = 8;
const parallelization = 1;
const keylen = 64;

const derivedKey = await promisify(crypto.scrypt)(
  password,
  salt,
  keylen,
  {
    cost: 2 ** logN,
    blockSize,
    parallelization,
  }
);

const saltB64 = salt.toString('base64').replace(/=+$/, '');
const derivedKeyB64 = derivedKey.toString('base64').replace(/=+$/, '');

const hashedPassword = `$scrypt$ln=${logN},r=${blockSize},p=${parallelization}$${saltB64}$${derivedKeyB64}`;
console.log(hashedPassword);

$ node scrypt-generate.js
$scrypt$ln=14,r=8,p=1$MlMsi/QCyoGB8JspGi7eBw$TEAAuts6soST2fyqhqYragWTjY24Hqaf/JVvQC14q+pm/XSqPgEjMlOeNMXLWQ7whzgFns18+xCYtzHm+L8uYA