Node.js

npm install jsonwebtoken

async function obtenerToken(base, password) {
  const response = await fetch('https://auth.mipos.co.cr/login', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ base, password }),
  });

  if (!response.ok) {
    const error = await response.json();
    throw new Error(error.message || 'Error de autenticación');
  }

  const { token, expires_in } = await response.json();
  return { token, expires_in };
}

// Uso
const { token } = await obtenerToken('mi_empresa', 'mi_password');

const jwt = require('jsonwebtoken');
const fs = require('fs');

const publicKey = fs.readFileSync('/ruta/segura/public.pem', 'utf8');

function authMiddleware(req, res, next) {
  const authHeader = req.headers.authorization || '';
  const token = authHeader.replace('Bearer ', '');

  if (!token) {
    return res.status(401).json({ error: 'Token no proporcionado' });
  }

  try {
    req.cliente = jwt.verify(token, publicKey, { algorithms: ['RS256'] });
    next();
  } catch (err) {
    res.status(401).json({ error: 'Token inválido o expirado' });
  }
}

// Uso en Express
app.get('/ventas', authMiddleware, (req, res) => {
  const base = req.cliente.base; // Identificador del cliente
  // ... lógica del endpoint
});

const { token } = await obtenerToken('mi_empresa', 'mi_password');

const ventas = await fetch('https://api.mipos.co.cr/ventas', {
  headers: { 'Authorization': `Bearer ${token}` },
}).then(r => r.json());