Every request to the ActivityInfo API acts on behalf of a user. ActivityInfo offers two ways to authenticate a request:
- a Personal API Token, which you generate in your own account settings, and
- an OAuth access token, which an application receives after a user grants it access.
In both cases you send the token in the Authorization header of the request. In both cases the request has exactly the permissions of the user the token belongs to: a token cannot read or change anything that the user cannot read or change.
Which method to use
Use a Personal API Token when you write a script, a notebook, or a connection from a tool such as Power BI or Tableau that works with your own data. You paste the token into the script or tool once, and it acts as you.
Use OAuth when you build an application that other people sign in to with their own ActivityInfo accounts. Each user approves your application on a consent screen in ActivityInfo, so your application never handles their password.
Personal API Tokens
Generate a Personal API Token in your account settings, as described in Personal API tokens. Each token has a scope of “Read-only” or “Read & Write”.
Send the Personal API Token as the value of the Authorization header:
curl -H "Authorization: Bearer <PERSONAL API TOKEN>" \
https://www.activityinfo.org/resources/databases
For clients that only support Basic Authentication, set the Personal API Token as the 'password', with any value in the username field:
curl -u anything:<PERSONAL API TOKEN> \
https://www.activityinfo.org/resources/databases
OAuth access tokens
ActivityInfo is an OAuth 2.1 authorization server. Your application sends the user to ActivityInfo, the user approves the request, and your application receives an access token that it sends in the same header:
curl -H "Authorization: Bearer <ACCESS TOKEN>" \
https://www.activityinfo.org/resources/databases
ActivityInfo issues access tokens through the authorization code flow with PKCE. The user chooses between two scopes on the consent screen:
| Scope | The application can |
|---|---|
activityinfo.read |
View the databases, forms and records the user has access to |
activityinfo.write |
Also add, edit and delete records on the user's behalf |
An access token expires one hour after ActivityInfo issues it. Your application exchanges the refresh token issued alongside it for a new access token, without asking the user again.
Users see every application they have approved on the “Authorized Applications” page of their account settings, and revoke access there. A revoked application loses access on its next request.
To connect your own application, see Registering an OAuth application.