Streque API

[grensjo]

I have started work on an API for Strequelistan, and thought I should write down some thoughts on what the API will be and not be. Please let me know if you have any opinions!

Goals:

• Simple: the API should only be able to perform a subset of tasks that are useful for external integrations (such as Sqrubben phone, IoT devices, birthday congratulation bots, or whatever fun stuff we may be able to come up with!)
• Expandable: it should be easy to add additional endpoints to the API as needed
• Low barrier of entry: any Streque user should be able to create API keys and start using the API without permission from an admin
• Secure: API keys should be long random strings, possible to revoke, only shown to the user once, and hashed in the database
• Non-destructive: we don’t want to lose data because of bugs in integrations or compromised keys

Anti-goals:

• Supporting alternative Streque frontends - the API should be small and only surface features useful for integrations
• Detailed permissions system, let’s keep it simple (admin/non-admin). If we later wish to add more dangerous features we could revisit this

[grensjo]

The Streque API is live since a couple of months back.