To allow access of the API to people other than our bot and web services (and to restrict the public from accessing sensitive endpoints), we need some form of authorization. For the ease of use in spreadsheets, we are going to use an API key system:
For both the REST and WS access points, the api key issued to a user will be passed as a parameter to log in.
[ ] Make an APIKey model, that has id, token, user_id, and disabled, and admin fields
The id field is just an autoincrementing number
The tokenfield is the JWT token used to poll the API
The disabled property is a boolean that will disable permissions for all requests (in case of abuse)
The admin property will give a token full permission for anything in the API (to be used only for the bot and web services)
To allow access of the API to people other than our bot and web services (and to restrict the public from accessing sensitive endpoints), we need some form of authorization. For the ease of use in spreadsheets, we are going to use an API key system: For both the REST and WS access points, the api key issued to a user will be passed as a parameter to log in.
id,token,user_id, anddisabled, andadminfieldsidfield is just an autoincrementing numbertokenfield is the JWT token used to poll the APIdisabledproperty is a boolean that will disable permissions for all requests (in case of abuse)adminproperty will give a token full permission for anything in the API (to be used only for the bot and web services)