Creating and providing external API with Wappler

Server Side Components
,
1

Hi everybody,
I need to provide APIs to third part partner from my Wappler WebApp.
I looked after third part software (postmann, xano, swagger, insomnia…) But since Wappler already generate JSON APIs it looks easier to use Wappler.

I’ve read across the differents topics and using Wappler as core looks the easiest, quickest way to deliver
(for example this topic: https://community.wappler.io/t/creating-jsonp-api/12663/10)

I need to provide secured access - I don’t want my APIs to be public and I need to autorise endpoints regarding the partner and the common-customer. ie I need APIs keys / token for each APIs user.

How could I manage with it?
ie. what is the best way to set these access? (Permission? users in DB?) I’m a bit lost.
And how should I do precisely to restrict access to server connect and load or insert needed infos / APIs users?

For the moment I need to provide few endpoints to list / collections and 1 insert.
And I only work with 1 partner to connect our 2 apps. For a demo case.
(This will grew up quickly during the next weeks)

Thanks for your answer.
Sylvain

2

I'm not sure the best way to generate API keys, but you can use regular credentials and add a Security Restrict option on the APIs to keep them from being available publicly. There's an option to define Permissions if you want to limit it to certain users.

image
image1003×482 22.7 KB

Also, I'm guessing you're going to want to provide standard REST method options, so please vote for this feature request. Right now Wappler only supports GET and POST, so you've got to build workarounds to allow for deletes and updates, which isn't following REST standards.

2 Likes
3

This might be an approach for building a mechanism for API keys.

2 Likes
4

You should not use the Security Restrict to secure your API. This will require the users to always login to your system before making any API calls. I suggest you create a special table to store users’ identity (ID) and their access tokens, which can be generated by the users using the system.

For each request, a unique access_token has to be provided which you can use check if it exists in the system and who such token belongs to. For a more secured access_token, you would have to use some cryptographic algorithms on the token provided by the user using from the server connect and compare with what you have in the system.

4 Likes
5

Thanks everybody for your smart answers!
I’ll gonna try both APIs made with wappler and DreamFactory (hosted on Digital Ocean) and see what happens.

6

If you don’t mind, please report back with your findings …

1 Like
7

I’d highly recommend JWTs for that. You can sign it and store something like the user_id and even permissions in there.

8

As far as I can see JWTs require a login, if a login has to be used then why not just use the Wappler security provider? Am I missing something?

9

You can use the JWT to authenticate the user and then log them in via security provider or just use the JWT itself and generate a cookie but that would require your own session system.

A JWT is just great for API token since you can sign it, store info and set an expiration date.

2 Likes
10

I will!

1 Like
11

Dear @tbvgl,

Is there any refrence for this(JWT) ?

13

You can get more info here: https://jwt.io/

14

Thanks @TMR. :handshake:

1 Like