Skip to main content
Question

RESTful API temp user tokens

  • February 6, 2021
  • 0 replies
  • 525 views
I have a couple of authorization questions about the REST API.  More specific to start with - the documentation mentions that I can get "a temporary authorization token, scoped to either an app or a table".  My assumption was that this meant one of

a) an application token valid for operations on the app itself or any of the tables within the app
b) a table-specific token valid for operations only on that particular table

However, (a) doesn't actually seem to work that way; when I use the app DBID in the call for a temporary token, that token does not work to authorize, for example, querying data from tables within that app.  Using a token retrieved for the specific table DBID works.  Is an app-level temp token really not meant to grant access to the app's tables?


The second question would be - is there any way to make use of the user's browser authentication with the REST API instead of explicitly providing tokens, the way the XML API can?  If not, this means that the UI I'm working on would have to not only generate and manage separate tokens for each of the over a dozen tables that it's working with, but to ensure that they all keep getting refreshed within the 5-minute temp token expiration interval.  Alternately, I suppose I could just fetch a new temp token for every API call I'm making, which would slow everything down.

The combination of the above auth issues is about enough to make me run screaming back to the XML API, which would be a shame; the new API looks more manageable in most other ways. I'd appreciate any advice (or pointers to more detailed documentation) that you can give me.
This topic has been closed for replies.

  • IvanKondrashov
  • Author
  • Quickbase Alumni
  • February 9, 2021
Made a start on a per-table token management solution for the UI, but anything to replace it or reduce the number of queries it has to perform would still be quite welcome. It seems really strange that something like this is basically required in order to work with the new API.
  • LukeStone
  • Quickbase Alumni
  • October 18, 2022
Hey,

This has been a frustrating problem that I've been tackling myself. 

I have created a solution which has been working for me. Maybe it could work for you. 

I have swapped out all my companies ID's, tokens and any reference to my company. 
All you'd need to do would be to copy the code, put in your field and table ids, app token and company QB domain. 

You could modify the code as you see fit.

Here is a link to my GitHub where you can look at how I got around it:

Dukemister/quick_base_temp_auth: A repository to show QuickBase developers how to use JavaScript to acquire and implement temporary authorization tokens in code pages. (github.com)

I hope this helps, please feel free to share.

All the best, 

Luke 
​

------------------------------
Luke Stone
------------------------------
    Terms & ConditionsAccessibility statement