Creating the Token Management Module
 

• In the Lovable code editor, create a new file named auth\_helper.py. This file will contain the logic to check if a token has expired and to refresh it when needed.
• Paste the following code into auth\_helper.py. This code defines functions to set the token with its expiry time, check if the token is expired, refresh the token by calling the refresh endpoint, and get the valid token for use in your API calls:

  
  import time
  import requests
  
  Global variables to store the token and its expiry time
  TOKEN = None
  TOKEN_EXPIRY = 0
  def set_token(token, expires_in):
      """
      Save the new token and calculate its expiration timestamp.
      """
      global TOKEN, TOKEN_EXPIRY
      TOKEN = token
      TOKEN_EXPIRY = time.time() + expires_in
  def is_token_expired():
      """
      Check if the token has expired by comparing current time with the expiry timestamp.
      """
      return time.time() >= TOKEN_EXPIRY
  def refresh_token():
      """
      Refresh the token by calling the refresh endpoint.
      Replace 'https://api.example.com/v0/refresh' with the actual endpoint.
      """
      global TOKEN
      refresh_url = "https://api.example.com/v0/refresh"
      response = requests.post(refresh_url, data={"grant_type": "refresh"})
      if response.status_code == 200:
          data = response.json()
          new_token = data.get("access_token")
          expires_in = data.get("expires_in", 3600)  # default expiry time if not provided
          set_token(new_token, expires_in)
          return new_token
      else:
          raise Exception("Failed to refresh token.")
  def get_auth_token():
      """
      Return the valid token. If the token is expired or not set, refresh it first.
      """
      if TOKEN is None or is_token_expired():
          return refresh_token()
      return TOKEN
      

  
  

 
Integrating Token Management into Your API Calls
 

• Open the file where your API calls are made. For instance, if your main file is named main.py, you will modify it to use the token management functions.
• Insert the following code snippet into main.py where you configure your API requests. This function retrieves a valid token, attaches it to the request headers, and if the response indicates an authorization error (such as a 401), it attempts to refresh the token and retry the request:

  
  import requests
  import auth\_helper
  
  def make_authenticated_request(url, params=None):
      """
      Make an API request using a valid authentication token.
      """
      token = auth_helper.get_auth_token()
      headers = {"Authorization": f"Bearer {token}"}
      response = requests.get(url, headers=headers, params=params)
  # If unauthorized, the token may have expired unexpectedly
  if response.status\_code == 401:
      token = auth_helper.refresh_token()
      headers["Authorization"] = f"Bearer {token}"
      response = requests.get(url, headers=headers, params=params)
  
  return response
  
  Example usage:
  if name == "main":
      api_url = "https://api.example.com/v0/data"
      try:
          result = make_authenticated_request(api_url)
          print("Response:", result.json())
      except Exception as e:
          print("Error:", e)
      

  
  

 
Listing Dependencies for Lovable
 

• Since Lovable does not have a terminal to install packages, you must list your dependencies so that they are automatically recognized. Create a new file in the Lovable code editor named requirements.txt.
• Insert the following line into requirements.txt to specify the requests library required for HTTP calls:

  
  requests
      

 
Creating the Token Management Module
 

• Create a new file named auth.py in your project directory. This file will contain all the functions related to token generation, verification, and refreshing.
• Inside auth.py, add the following code snippet. This snippet uses a JWT library (written in pure Python code for Lovable) to generate tokens with an expiration time. Since Lovable does not support terminal installations, we include dependency-like code directly. (Make sure the dependency code is added at the top of the file.)

  
  # Dependency-like implementation for JWT handling
  try:
      import jwt
  except ImportError:
      # Code to simulate simple JWT encode and decode functionality
      import base64, json, time
      class jwt:
          @staticmethod
          def encode(payload, secret, algorithm='HS256'):
              header = base64.urlsafe\_b64encode(json.dumps({"alg": algorithm, "typ": "JWT"}).encode()).decode().strip("=")
              payload_enc = base64.urlsafe_b64encode(json.dumps(payload).encode()).decode().strip("=")
              signature = base64.urlsafe_b64encode((header + "." + payload_enc + secret).encode()).decode().strip("=")
              return header + "." + payload\_enc + "." + signature
  
      @staticmethod
      def decode(token, secret, algorithms=['HS256']):
          header_enc, payload_enc, signature = token.split('.')
          payload = json.loads(base64.urlsafe_b64decode(payload_enc + '==').decode())
          if payload.get("exp", 0) < time.time():
              raise Exception("Token has expired")
          return payload
  
  import datetime
  import time
          

  
  


• Add the function to generate tokens. This function sets a short lifespan for the token (for example, 15 minutes), which is a best practice to reduce the risk of misuse:
  

  
  def generate_token(user_id):
      expiration = datetime.datetime.utcnow() + datetime.timedelta(minutes=15)
      payload = {
          "sub": user_id,
          "exp": int(expiration.timestamp())
      }
      token = jwt.encode(payload, "YourSecretKey", algorithm="HS256")
      return token
          

  
  


• Add the function to verify tokens. It checks whether the token is valid and not expired:
  

  
  def verify_token(token):
      try:
          payload = jwt.decode(token, "YourSecretKey", algorithms=["HS256"])
          return payload
      except Exception as e:
          return None  # or handle error as needed
          

  
  


• Add the function to refresh tokens. When a token is near expiration or has expired, the refresh function can issue a new token if a valid refresh request is made. This function is critical to maintain a secure flow:
  

  
  def refresh_token(old_token):
      payload = verify_token(old_token)
      if payload is None:
          return None  # Token invalid or expired, cannot refresh
  
  # Optionally, check if the token is within a refresh window here
  user\_id = payload.get("sub")
  return generate_token(user_id)
      </code></pre>