The Data feed (API): developer guide

openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out company-private.pem
openssl pkey -in company-private.pem -pubout -out company-public.pem

GET https://research-tree-api.com/api/partners/erf/companyfeed/{partnerTag}

// npm install jsonwebtoken
import { readFileSync } from 'node:fs';
import jwt from 'jsonwebtoken';

const privateKey = readFileSync('company-private.pem', 'utf8');

export async function fetchResearchFeed() {
  const token = jwt.sign({}, privateKey, {
    algorithm: 'RS256',
    issuer: process.env.RT_CLIENT_TOKEN,
    audience: 'ResearchTree',
    expiresIn: '30m',
  });
  const url = new URL(process.env.RT_FEED_URL); // exactly as we sent it
  url.searchParams.set('pageLength', '20');
  const response = await fetch(url, { headers: { Authorization: `Bearer ${token}` } });
  const feed = await response.json();
  if (feed.Message) throw new Error(feed.Message); // errors arrive as HTTP 200
  return feed.Items;
}

# pip install "pyjwt[crypto]" requests
import os
import time

import jwt
import requests

with open("company-private.pem") as handle:
    PRIVATE_KEY = handle.read()


def fetch_research_feed() -> list[dict]:
    now = int(time.time())
    claims = {"iss": os.environ["RT_CLIENT_TOKEN"], "aud": "ResearchTree", "iat": now, "exp": now + 1800}
    token = jwt.encode(claims, PRIVATE_KEY, algorithm="RS256")
    response = requests.get(
        os.environ["RT_FEED_URL"],  # exactly as we sent it
        params={"pageLength": 20},
        headers={"Authorization": f"Bearer {token}"},
        timeout=10,
    )
    feed = response.json()
    if feed.get("Message"):  # errors arrive as HTTP 200
        raise RuntimeError(feed["Message"])
    return feed["Items"]

// supabase/functions/research-feed/index.ts
import { importPKCS8, SignJWT } from 'npm:jose@5';

// Secrets set with `supabase secrets set`. A PEM pasted into one secret keeps
// its line breaks as \n, so put them back before reading the key.
const PRIVATE_KEY = Deno.env.get('RT_PRIVATE_KEY')!.replace(/\\n/g, '\n');
const CLIENT_TOKEN = Deno.env.get('RT_CLIENT_TOKEN')!;
const FEED_URL = Deno.env.get('RT_FEED_URL')!; // exactly as we sent it
const CORS = { 'Access-Control-Allow-Origin': 'https://www.yourcompany.com' };

Deno.serve(async (request) => {
  if (request.method === 'OPTIONS') {
    return new Response(null, { headers: { ...CORS, 'Access-Control-Allow-Headers': 'authorization, content-type' } });
  }
  const token = await new SignJWT({})
    .setProtectedHeader({ alg: 'RS256', typ: 'JWT' })
    .setIssuer(CLIENT_TOKEN)
    .setAudience('ResearchTree')
    .setIssuedAt()
    .setExpirationTime('30m')
    .sign(await importPKCS8(PRIVATE_KEY, 'RS256'));

  const url = new URL(FEED_URL);
  url.searchParams.set('pageLength', '20');
  const feed = await (await fetch(url, { headers: { Authorization: `Bearer ${token}` } })).json();
  if (feed.Message) {
    return Response.json({ error: feed.Message }, { status: 502, headers: CORS });
  }
  return Response.json(feed.Items, { headers: { ...CORS, 'Cache-Control': 'max-age=300' } });
});