How-to :: Use the HTTP Api connector in advanced use cases¶
Hi dear App Builder,
This documentation is made to showcase advanced use cases using the HTTP API Connector. It will expose three use cases to handle API at Scale:
- Handle Bearer token in Header - Static authentication
- Execute a first API Call for Authentication
- Handle Token in Token - Dynamic Authentication
Handle Bearer Token in Header - Static Authentication¶
This use case is useful when you have an API that needs a Bearer Token (Token Access) in the header of your API call. In this situation we suppose that the access to your data is static. It is assumed that there is only one “service account” accessing a non-variable data item.
In order to setup this you have to create a HTTP API Connector and add Template > Header option as below at connector level.
Then you just have to use your API creating a Query from this Connector and call your application Endpoint. The Header with the Bearer Token will be systematically sent to your SaaS API.
Execute a first API Call for Authentication¶
The first use case is a classical one in the software industry. However, APIs often need to use a temporary access token, dynamically retrieved when a first authentication call is made. This access token is then sent during the application call, along with parameters, to retrieve data.
This solution is effective, and here again, the account service is static. Depending on the API, some parameters are requested, as in the example below with 4 parameters:
- a grant_type
- an account
- a username
- a password
In this case, the call is encrypted (HTTPS) and sent as a POST. We can do even better in terms of security, as we’ll see in the 3rd scenario.
Again, you just have to use your API creating a Query from this Connector and call your application Endpoint.
Handle Token in Token - Dynamic Authentication¶
Finally, the state of the art offers us a third situation, which works very well in an embedded analytics context. In this situation, a software editor (in SaaS for example), wishes to integrate visualizations and show data from Paul to Paul, and data from Mary to Mary, who are two users with different rights.
In this context, the ideal scheme is for the SaaS vendor to manage authentication, with an initial call to its Authentication API. The access token generated by this call can then be sent dynamically to Toucan, in a JWT.
When Toucan is used in an embedded analytics context, it can open this JWT to extract user attributes. These user attributes may contain a token access sent by the SaaS embedding Toucan visualizations.
Finally, this user attribute containing the access token is sent in the header of an API call, as seen in the first scenario.
The screenshot below shows the API connector that dynamically injects user attributes into a header. These attributes come from the JWT.
As always, you just have to use your API creating a Query from this Connector and call your application Endpoint. Why not with some parameters if needed, here from our beloved Date Selector.
Thanks using Toucan and see you soon to share your experience with our Product!