I have started work on an API for Strequelistan, and thought I should write down some thoughts on what the API will be and not be. Please let me know if you have any opinions!
Goals:
Simple: the API should only be able to perform a subset of tasks that are useful for external integrations (such as Sqrubben phone, IoT devices, birthday congratulation bots, or whatever fun stuff we may be able to come up with!)
Expandable: it should be easy to add additional endpoints to the API as needed
Low barrier of entry: any Streque user should be able to create API keys and start using the API without permission from an admin
Secure: API keys should be long random strings, possible to revoke, only shown to the user once, and hashed in the database
Non-destructive: we don’t want to lose data because of bugs in integrations or compromised keys
Anti-goals:
Supporting alternative Streque frontends - the API should be small and only surface features useful for integrations
Detailed permissions system, let’s keep it simple (admin/non-admin). If we later wish to add more dangerous features we could revisit this
I have started work on an API for Strequelistan, and thought I should write down some thoughts on what the API will be and not be. Please let me know if you have any opinions!
Goals:
Anti-goals: