Difference between revisions of "API Authentication"
From Charitylog Manual
| Line 1: | Line 1: | ||
[[File:helpheader_small.png|right]] | [[File:helpheader_small.png|right]] | ||
| − | The API grants access based on three headers: | + | API access requires being a user of the system. A user in this context is anyone who has access to your data. Each user has a 2 tabs on their record which control this: |
| + | * The Website and Call-round Access tab controls access to your data via our website, and/or our mobile app, Call Round. | ||
| + | * The 3rd Party Systems tab controls the access to your data that other systems have via the API | ||
| + | Using this approach, there are 3 possibilities: | ||
| + | * Website/Call-round access only. This will be most users of the system doing day-to-day tasks | ||
| + | * API access only. This could be to migrate data in from other systems, reporting dashboards etc | ||
| + | * Both. An example of this would be if Alice sometimes logs in via the website, and sometimes using a 3rd party app. Alice's access controls are the same in both situations, i.e. she will have the same access to branches, projects and fields. | ||
| + | |||
| + | Instead of a user name and password, the API grants access based on three headers: | ||
* Source. Identifies the 3rd party software provider | * Source. Identifies the 3rd party software provider | ||
* Org. Identifies the charity or company | * Org. Identifies the charity or company | ||
* User. Identifies the user within the charity or company. This controls branch, project and field visibility, as if the user were using the web interface. | * User. Identifies the user within the charity or company. This controls branch, project and field visibility, as if the user were using the web interface. | ||
Revision as of 16:31, 9 April 2020
API access requires being a user of the system. A user in this context is anyone who has access to your data. Each user has a 2 tabs on their record which control this:
- The Website and Call-round Access tab controls access to your data via our website, and/or our mobile app, Call Round.
- The 3rd Party Systems tab controls the access to your data that other systems have via the API
Using this approach, there are 3 possibilities:
- Website/Call-round access only. This will be most users of the system doing day-to-day tasks
- API access only. This could be to migrate data in from other systems, reporting dashboards etc
- Both. An example of this would be if Alice sometimes logs in via the website, and sometimes using a 3rd party app. Alice's access controls are the same in both situations, i.e. she will have the same access to branches, projects and fields.
Instead of a user name and password, the API grants access based on three headers:
- Source. Identifies the 3rd party software provider
- Org. Identifies the charity or company
- User. Identifies the user within the charity or company. This controls branch, project and field visibility, as if the user were using the web interface.
