Trusted apps
Apps operated by Anikeen can be marked as trusted. A trusted app can do more than a third-party app:
- it checks out orders and subscriptions directly, without sending the user to a confirmation page (it can still ask for a confirmation with confirmable orders and checkout sessions),
- it uses its own token (OAuth client credentials) for the
/api/v1/client/…endpoints, so billing keeps working when the user's login expired.
What the app token can do
| Feature | Endpoint prefix | Scope of the app token | Also needs |
|---|---|---|---|
| App subscriptions | /api/v1/client/subscriptions | subscriptions:client | – |
| Checkout sessions | /api/v1/client/checkout-sessions | subscriptions:client | – |
| App orders | /api/v1/client/orders | orders:client | – |
| Billing portal links | /api/v1/client/users/{user}/billing-portal | subscriptions:client or orders:client | – |
| Charges | /api/v1/client/users/{user}/charges | billing:client | charging enabled by Anikeen |
| Billing limit | /api/v1/client/users/{user}/billing-limit | billing:client | charging enabled, or limit reading allowed by Anikeen |
| Profile by ID | /api/v1/client/users/{user} | – | – |
| Preferences of any user | /api/v1/client/users/{user}/preferences/… | preferences:client | namespaces registered by Anikeen |
| SSH keys of a user | /api/v1/client/users/{user}/ssh-keys | ssh-keys:read or ssh-keys | – |
| Account lookup and creation | /api/v1/admin/users… | – | – |
Get the app token with the client credentials grant (see Sign in). The SDK does that for you in every app*() method.
Connected users
Charges, the billing limit and profiles by ID only work for users connected to your app: the user authorised your app (they hold a token of it that isn't revoked), or your app bills them through a running subscription or a placed order. Unknown, deleted and unconnected users all answer the same 404 user_not_found, so an app can't probe for accounts.
The user's role
Trusted apps also see the user's Anikeen ID role: admin (runs Anikeen) or user. Other apps never get it. An app can make Anikeen ID admins its own admins this way instead of keeping a list of its own; keep it current with the user.updated webhook, which sends role in changed to trusted apps only.
Errors
The app-token endpoints answer 403 when the token isn't the client credentials token of a trusted app: with the code client_not_allowed for charges, the billing limit and profiles by ID, client_not_trusted for preferences, and without a code (only a message) on the other endpoints.