Automating generating LWA Tokens

Question

Is there any way I can use an API to generate LWA Tokens for ALEXA Skill Management API authorization?

Right now, I am generating LWA tokens through ASK-CLI and copying-pasting into the ASK-SMAPI-SDK code. Is there any API/way to automate this process?

Any help is greatly appreciated.

Answer 1

There are multiple ways to interpret your question..

One is you want various customers/accounts to be able to login and generate a token with the web interface instead of you having to manually generate it through the CLI.

If so, there are a number of OAuth libraries that support LWA. Last one I messed with was Passport (for Node), but that was a while ago. Just make sure you're requesting the right scopes because most of the libraries default to the the profile scope.

Another is that you're generating tokens every time you want to run your script because they expire.

In that case, the ask util generate-lwa-tokens command returns an access token and a refresh token. The access token is good for an hour. The refresh token is good indefinitely, but needs to be traded for a new access token when the last one runs out (usually 3600 seconds after issue).

Consider using the ASK SMAPI SDK.

https://developer.amazon.com/en-US/blogs/alexa/alexa-skills-kit/2020/05/three-tips-for-coding-with-the-alexa-smapi-sdk

In the SDK, you feed the SDK client your access token and refresh token. If the access token is dust, it will get you a new one with the refresh token and use that. The SDK does some of the heavy lifting for you, so you might want to consider it.

But maybe you've written your own scripts and don't want to convert them. Here are the LWA docs on using your refresh token in case you want to write your own client. IT's a REST API, so you just have to be able to generate the HTTP request.

https://developer.amazon.com/docs/login-with-amazon/retrieve-token-other-platforms-cbl-docs.html#using-refresh-tokens

Workflow is like this...

• try the call with the access token
• if you get a 400 "invalid_token" error, it's probably expired
  • try using the refresh token to get a new token
    • If that works, start using the new token until it expires

Answer 2

You can hit SMAPI from Node is to using the SMAPI Node.js SDK, with docs available here with a refresh token you generate using using the ASK CLI. You only have to generate the refresh token once, and then you can use it repeatedly.

In order to authenticate with SMAPI, you're going to need to do the following:

1. Set up an LWA security profile.
2. Use the ASK CLI to exchange your LWA Client ID and Client Secret for an LWA refresh token using ask util generate-lwa-tokens --client-id <Client ID> --client-confirmation <Client Secret>.
3. Use this refresh token when you initialize the SMAPI node SDK:

const Alexa = require('ask-smapi-sdk');

// specify the refreshTokenConfig with clientId, clientSecret and refreshToken generated in the previous step
const refreshTokenConfig = {
    clientId,
    clientSecret, 
    refreshToken
}
const smapiClient = new Alexa.StandardSmapiClientBuilder()
    .withRefreshTokenConfig(refreshTokenConfig)
    .client();

You will then be able to hit SMAPI through function calls on the SDK!

Helpful resource on this: https://levelup.gitconnected.com/email-yourself-daily-alexa-skill-metrics-updates-using-lambda-smapi-and-ses-9c16ac97c1f8