How can we help?

Authentication helps ensure that communication between software systems is authorized. External APIs and webhooks may use different authentication mechanisms depending on the provider, the integration implementation, and the security requirements of the operation. Understanding these mechanisms is important when connecting business systems to Polyosync. Common API authentication methods API keys An API key is a credential issued by a service provider to identify or authorize API access. OAuth OAuth is an authorization framework that allows applications to receive limited access to supported resources without requiring users to share their passwords directly with the requesting application. Bearer tokens A bearer token is a credential commonly included in an HTTP authorization header. Basic authentication Some services support authentication using a username and password or another credential pair. Custom authentication Certain enterprise systems use proprietary authentication mechanisms or additional security controls. The availability of each method in Polyosync depends on the supported integration functionality. How is webhook authentication different? Webhook authentication focuses on verifying that an incoming event was sent by an authorized source. Common verification mechanisms include: 1. Cryptographic signatures. 2. Shared secrets. 3. Authorization headers. 4. Provider-specific verification procedures. The appropriate mechanism depends on the sender and receiver. What is a webhook signature? Some providers generate a cryptographic signature using a shared secret and information from the request. The receiving system can verify the signature to help determine whether the request is authentic and has not been altered. Can I use the same credentials for multiple integrations? This depends on the provider and your organization's security policy. Separate credentials are often preferable because they allow access to be restricted and revoked independently. What permissions should I grant? Grant only the permissions required for the intended operation. For example, a process that only needs to retrieve information should not receive write permissions unless they are necessary. What happens when an API token expires? Requests using an expired token may fail until valid authorization is restored. Some providers support token renewal mechanisms, while others require manual reauthorization. The behavior depends on the provider and integration implementation. How should credentials be handled? 1. Never publish API keys or access tokens. 2. Avoid placing credentials in public URLs. 3. Do not include secrets in support screenshots. 4. Rotate credentials when required. 5. Revoke credentials that are no longer needed. 6. Use separate test and production credentials where supported. 7. Review permissions periodically. 8. Restrict who can manage integration credentials. What if credentials are compromised? Revoke or rotate the affected credentials through the external provider. Review relevant access activity and investigate whether unauthorized operations occurred. Update the affected integration configuration before resuming normal operation. Does authentication guarantee that an operation is safe? No. Authentication establishes identity or authorization, but additional validation and business controls may still be required. Recommended approach Use the strongest authentication mechanism supported by the integration and external provider. Apply least-privilege permissions and maintain a clear process for credential renewal and revocation.