How can we help?

OAuth and API credentials are two common methods used to authorize connections between software applications. Both methods can enable an integration to interact with an external service, but they differ in how access is established and managed. The method used by a Polyosync integration depends on the external provider and the supported implementation. What is OAuth? OAuth is an authorization framework that allows an application to receive delegated access to another service without requiring the user to provide their account password directly to that application. A typical OAuth connection involves: 1. Starting the connection from Polyosync. 2. Being redirected to the external provider. 3. Signing in to the external account if necessary. 4. Reviewing the requested permissions. 5. Approving the authorization request. 6. Returning to Polyosync after the authorization process. The provider may issue access credentials that allow the authorized integration to perform supported operations. What is an API key? An API key is a credential used by an external service to identify or authorize API requests. Some providers allow users or administrators to generate API keys through their own account settings. Depending on the provider, an API key may have specific permissions, restrictions, or expiration rules. How are these methods different? OAuth commonly involves an interactive authorization process managed by the external provider. API key integrations commonly involve configuring a credential generated through the external service. Both methods can have security restrictions, access limitations, and revocation mechanisms. Which method is more secure? Security depends on the provider's implementation, the permissions granted, credential handling, and operational configuration. OAuth can reduce the need to share account passwords and can support delegated access. API keys can also be used securely when appropriately restricted and protected. Neither method should be considered automatically secure without proper configuration. Do all integrations support both methods? No. The external provider and the Polyosync integration determine which authorization methods are available. Can OAuth access expire? Yes. Access credentials may expire or become invalid. Some integrations support token renewal, but this behavior depends on the provider and implementation. Can API keys expire or be revoked? Yes. Providers may allow API credentials to expire, be rotated, or be revoked. If a required credential becomes invalid, the integration may stop working until authorization is restored. Should I create a dedicated external account for integrations? Where supported and appropriate, a dedicated service account can help separate integration access from personal employee accounts. However, the correct approach depends on the external provider's policies and your organization's security requirements. What should I do if a credential is exposed? Revoke or rotate the affected credential through the external provider as soon as possible. Review relevant access and activity records where available. Update the integration configuration using a replacement credential. Contact your security administrator if necessary. Important security practices Never include API keys, access tokens, client secrets, or passwords in support tickets. Do not store credentials in publicly accessible documents or repositories. Use the narrowest permissions supported by the external service. Review and revoke connections that are no longer needed. Understanding the authorization method helps administrators configure integrations responsibly and troubleshoot connection problems without weakening security.