Skip to main content

Authorization

eZintegrations platform supports all sort of Authorization for any standard APIs like REST API, SOAP API, gRPC or GraphQL.

The major Authorizations are :-

  • API Key
  • Basic Authentication
  • OAuth1.0
  • OAuth2.0
  • AWS Signature
  • NTLM Authentication
  • Custom Algorithm Signature
  • Any other custom architecture based Authorization

API Key

API Key Authorization is a method used to secure access to an API (Application Programming Interface) by requiring clients to include a unique API key when making requests. This key is typically a long alphanumeric string that is issued to the client by the API provider. API keys serve as a form of authentication and authorization, allowing the API provider to identify and control access to their API.

The API provider generates a unique API key for each client or application that needs access to their API. This key is often associated with specific usage limits or permissions.

Clients must include their API key in the headers or query parameters of their API requests. This key is used to identify the client making the request.

API Key is key-value pair based authorization where the key is Authorization and the value which is one time string generated from Application while enabling the API for defined set of action with roles and privileges.

There are various application whose API Key are static and its a one time activity to enable those keys, keep them in secret mode and use them for API Authorization

Authorization : noKWB57FVhzjh11FRIv9HEghY94gXHyoFPPS3QlHEtbGIZnMqDsPjsCiWkoDNE7W6UA2gclTtZTs4dZbiP20a9shY06IX5icKkRSdcQBnDTyaRno5BQphBdW0sX6sQto

In eZntegrations API Data Source user can select Type as  No Auth under Authorization and under Headers call the key as Authorization and the value as you get from the application 


image.png

And under Headers add the key-value pair

image.png

Basic Authentication

Basic Authentication is a simple method of authenticating access to an API (Application Programming Interface) by sending a username and password with each HTTP request.

In eZintegrations for Source, Operations and Target APIs user can select Type as  Basic Auth under Authorization Tab

image.png

OAuth 1.0

OAuth 1.0: OAuth 1.0 is an open standard protocol that allows third-party applications to access a user's resources (e.g., data) on a server without exposing the user's credentials. It relies on cryptographic signatures and token-based authentication for secure API access.

Here are some key components and steps in the OAuth 1.0 process:

  1. Consumer: The consumer is the third-party application or service that wants to access a user's data on a resource server.

  2. Service Provider (Provider): The service provider is the entity that hosts the user's resources and manages access to them. It includes popular platforms like Twitter and Flickr.

  3. User: The user is the resource owner who has data on the service provider's platform.

  4. Token: OAuth 1.0 uses temporary tokens (OAuth token) to grant access to resources. These tokens are issued by the service provider.

  5. Signature: OAuth 1.0 requires the use of cryptographic signatures to ensure the integrity and authenticity of API requests.

Since OAuth 1.0 is versatile and hard to predict, eZintegrations provides flexibility to write Python code under Pre-request Script to achieve the token or signature for Authorization requirement. If user is not aware as how to use the OAuth 1.0, plenty of examples available under section Pre-Request Script

image.png

OAuth 2.0

OAuth 2.0: OAuth 2.0 is an authorization framework that enables third-party applications to access a user's data or perform actions on a user's behalf through a secure and standardized process. It defines various authorization grant types and flows for different use cases.

Key components and steps in the OAuth 2.0 process:

  1. Resource Owner: The resource owner is the user who has control over their resources and data.

  2. Client: The client is the third-party application or service that wants to access the user's resources on a resource server.

  3. Resource Server: The resource server hosts the user's data and resources, which the client wants to access.

  4. Authorization Server: The authorization server is responsible for authenticating the user and issuing access tokens to the client after the user grants consent.

  5. Access Token: OAuth 2.0 uses access tokens, which are short-lived credentials that the client presents to the resource server to access protected resources. They can also include scopes that define the level of access the client has.

In eZintegrations for Source, Operations and Target API user can select the Type as OAuth 2.0

image.png

When working with OAuth 2.0 and sending data in URL-encoded format, user can provide values in the Refresh Token Endpoint Body field in the following format :

{
    "grant_type":"password",
    "client_id":"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
    "client_secret":"XXXXXXXXXXXXXXXXXXXXXXXX",
    "username":"XXXXXXXXXXXXXXXXXXXXXXX",
    "password":"XXXXXXXXXXXXXXXXXXXXXXXXX"
 }

When dealing with OAuth 2.0 and sending data in URL-encoded format as a string, you can provide values in the Refresh Token Endpoint Body field using the following format:

"client_id=XXXXXXXXXXXXXXXXX&client_secret=XXXXXXXXXXX&grant_type=refresh_token&refresh_token=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Back to top