ABRA Flexi allows you to use contacts stored in the database for authentication — typically when you want to give customers from your address book a login to your own application or e-shop, without creating user accounts for them in Flexi. Using the REST API, you first set a username and password for the contact, and then it can be used for authentication.
Setting the username and password
The username and password are set on the contact via a standard import into the kontakt record. The password can be sent in two ways.
Password in plain text
The simplest option — the hash and salt attributes remain empty:
PUT https://demo.flexibee.eu/c/demo/kontakt.xml
<?xml version="1.0"?>
<winstrom version="1.0">
<kontakt>
<id>1</id>
<username>jan</username>
<password hash="" salt="">heslo</password>
</kontakt>
</winstrom>
A password sent in plain text is stored securely by ABRA Flexi using a hash function. When reading the contact, the password property is always empty — the stored hash is never returned via the API.
Password as a hash function result
The password can also be sent already hashed. In this case, the hash and salt attributes are required:
PUT https://demo.flexibee.eu/c/demo/kontakt.xml
<?xml version="1.0"?>
<winstrom version="1.0">
<kontakt>
<id>1</id>
<username>jan</username>
<password hash="sha256" salt="abcd">24b7f0b1ec27ba0dd0d0a4a2e1a3b5a7c9d1e3f5a7b9c1d3e5f7a9b1c3d5e7f9</password>
</kontakt>
</winstrom>
The value of the password element is the result of a hash function applied to a string formed by joining the value of salt, a colon, and the password — i.e. salt + ":" + heslo. The result is written as a lowercase hexadecimal string. In this case, it is not necessary to send the original password.
💡 The order and the colon matter. For a password of tajne and salt equal to abcd, the string abcd:tajne is hashed — not tajneabcd or abcdtajne.
Supported hash function types:
Value of the | Note |
| Default function for storing passwords sent in plain text. |
| — |
| — |
| — |
| The most secure but also significantly slowest method — it is intentionally slow. |
⚠️ Any other value of the hash attribute will result in a 400 error with code hashInvalid and the message Unsupported value of the hash attribute.
Contact authentication
A contact is authenticated by sending a POST request to the authenticate action. The username and password are sent as form data:
POST https://demo.flexibee.eu/c/demo/kontakt/1/authenticate
Accept: application/xml
Content-Type: application/x-www-form-urlencoded
username=jan&password=heslo
Authentication also works on the generic contacts URL, i.e. without specifying a particular record:
POST https://demo.flexibee.eu/c/demo/kontakt/authenticate
Accept: application/xml
Content-Type: application/x-www-form-urlencoded
username=jan&password=heslo
The password is always sent to the authenticate action in plain text — even if you set it up as already hashed. ABRA Flexi calculates the hash itself.
Result
🚨 The result is always a response with HTTP status 200 — even if authentication fails. Never judge success based on the status code, but exclusively on the success property in the response body.
Successful authentication:
<?xml version="1.0"?>
<winstrom version="1.0">
<success>true</success>
<message/>
</winstrom>
Failed authentication:
<?xml version="1.0"?>
<winstrom version="1.0">
<success>false</success>
<message>Bylo zadáno chybné uživatelské jméno či heslo.</message>
</winstrom>