Документация за разработчици

// Node 18+ (built-in fetch). Хвани го зад твоя endpoint
// и НИКОГА не давай SECRET на frontend-а.
const SECRET = process.env.NAPI_SECRET;   // "napi_test_…"

export async function issueNapiJwt(typeId, eik) {
  const r = await fetch("https://napi.bg/api/v1/tokens/issue", {
    method:  "POST",
    headers: {
      "Authorization": `Bearer ${SECRET}`,
      "Content-Type":  "application/json"
    },
    body: JSON.stringify({ typeId, eik })
  });
  if (!r.ok) throw new Error(`napi.bg ${r.status}: ${await r.text()}`);
  return r.json();   // { token, jti, expiresAt, issuer }
}

// ASP.NET — регистрирай HttpClient в DI с BaseAddress.
public sealed class NapiTokenClient(HttpClient http, IConfiguration cfg)
{
    private readonly string _secret = cfg["Napi:Secret"]!;  // "napi_test_…"

    public async Task<JsonDocument> IssueAsync(string typeId, string eik)
    {
        using var req = new HttpRequestMessage(HttpMethod.Post,
            "https://napi.bg/api/v1/tokens/issue");
        req.Headers.Authorization = new("Bearer", _secret);
        req.Content = JsonContent.Create(new { typeId, eik });
        using var res = await http.SendAsync(req);
        res.EnsureSuccessStatusCode();
        return JsonDocument.Parse(await res.Content.ReadAsStringAsync());
    }
}

import os, requests

SECRET = os.environ["NAPI_SECRET"]   # "napi_test_…"

def issue_napi_jwt(type_id: str, eik: str) -> dict:
    r = requests.post(
        "https://napi.bg/api/v1/tokens/issue",
        headers={
            "Authorization": f"Bearer {SECRET}",
            "Content-Type":  "application/json",
        },
        json={"typeId": type_id, "eik": eik},
        timeout=10,
    )
    r.raise_for_status()
    return r.json()   # {"token": "...", "jti": "...", "expiresAt": "...", "issuer": "napi.bg"}

<?php
// PHP 8 + curl. $SECRET идва от .env / config — не от потребителя.
$SECRET = getenv('NAPI_SECRET');   // "napi_test_…"

function issue_napi_jwt(string $typeId, string $eik): array {
    global $SECRET;
    $ch = curl_init('https://napi.bg/api/v1/tokens/issue');
    curl_setopt_array($ch, [
        CURLOPT_POST           => true,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER     => [
            "Authorization: Bearer $SECRET",
            'Content-Type: application/json',
        ],
        CURLOPT_POSTFIELDS     => json_encode(['typeId' => $typeId, 'eik' => $eik]),
    ]);
    $body   = curl_exec($ch);
    $status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);
    if ($status >= 300) throw new RuntimeException("napi.bg $status: $body");
    return json_decode($body, true);   // ['token' => …, 'jti' => …, 'expiresAt' => …, 'issuer' => …]
}