Skip to main content
X
xotzHelper1-Visitor
1-Visitor
August 10, 2020
Solved

Isolate appKey to single project or thing

  • August 10, 2020
  • 1 reply
  • 2355 views

Hello, it is possible to to isolate an appkey to project or thing on thingworx 8.5.5. If so can you provide a guide please. Thank you.

Best answer by VladimirRosu_116627

Hi @xotzHelper ,

Your thinking is very wise, and it should be the common baseline for every developer.

Since, as mentioned above, the appKey is linked only to an User you need to create a specific user, we usually call it a "technical user" which has rights only for the service you need to execute.

Note: This user should not be part of the ComposerUser group - also make sure you remove the Users from the Everyone organization (check this help center link for security best practices).

 

You also said that that service needs to have acces to features available to administrators, but I would challenge if you can't use the System User concept for this. Look at this link for additional details.

 

At the end of the day you must make sure that that "Technical User" has:

-visibility to the Entity that hosts the service you want to execute

-Service execution rights (for him or for the System User) for the service you need to consume internally.

 

Let me know if that helps.

1 reply

M
mnarang5-Regular Member
5-Regular Member
August 10, 2020

Appkeys are associated with users in ThingWorx. Multiple users can have one app key or there can be unique app key for every user. So they are isolated at user level, there is no direct provision to map app key to Thing/Project. Can you please elaborate your use case for this request ?

 

 

Thanks,

Mukul Narang

    X
    xotzHelper1-VisitorAuthor
    1-Visitor
    August 10, 2020

    I'm trying to use a service in a plubic web page and i wanted to isolate the api-key so it doesn't become a security risk. One constraint i have is that i need some functions that are only accessible on admin group.

     

    Thanks.

    M
    mnarang5-Regular Member
    5-Regular Member
    August 10, 2020

    In that case I believe you will be doing REST to ThingWorx from that public web page and in the REST request you would need app key for authentication. I think you are sending the app key in the REST request header, for security you can use SSL certs between the web page and ThingWorx so that your request will be encrypted. But for authentication you would definitely need a way which is app key in ThingWorx.

     

     

     

    Thanks,

    Mukul Narang

    Terms & ConditionsCookie settingsAccessibility statement