Web API Authentication

Keep in mind that authentication for APIs really means two things:

• Ensuring the request authenticates using a valid Appian account
• Using Appian object level security to ensure that user has access to this Web API (and its precedent objects)

The reason that service accounts are needed for API keys is that all object-level security in Appian is configured using users + groups. So if someone authenticates using an API key, the user context used to evaluate whether they have access to the object or not is based on the service account.

As far as basic authentication, there's no configuration required in Appian to allow authenticating using basic auth - just provide the username and password as part of the request. There's no way to disable using basic authentication (that I'm aware of), but you can still disable it in all practical senses by limiting the security on your Web API to only users in the service accounts group. Then, there wouldn't be any users that could authenticate using basic authentication.

Keep in mind that authentication for APIs really means two things:

• Ensuring the request authenticates using a valid Appian account
• Using Appian object level security to ensure that user has access to this Web API (and its precedent objects)

The reason that service accounts are needed for API keys is that all object-level security in Appian is configured using users + groups. So if someone authenticates using an API key, the user context used to evaluate whether they have access to the object or not is based on the service account.

As far as basic authentication, there's no configuration required in Appian to allow authenticating using basic auth - just provide the username and password as part of the request. There's no way to disable using basic authentication (that I'm aware of), but you can still disable it in all practical senses by limiting the security on your Web API to only users in the service accounts group. Then, there wouldn't be any users that could authenticate using basic authentication.

Thanks Peter Lewis for the elaborate response. Just one confusion, for basic authentication, what are the credentials do we provide to client/requestor, is it we create a new basic user account for them in the environment and provide those creds to access or is it something else?

Yes the credentials are just the username + password for the user account. See this sample for a request that uses basic authentication: docs.appian.com/.../Web_API_Authentication.html

Thanks Peter Lewis, that helped.