Update authentication guidelines for token acquisition - #96
amandine-mestre wants to merge 3 commits into
Conversation
Clarified the process for obtaining Client and Connection Tokens, including additional methods for acquiring Connection Tokens.
moxly
left a comment
moxly
left a comment
There was a problem hiding this comment.
Risk Assessment
Score: 3/10 — low
This is a documentation-only change, but one authentication description could misdirect integrators when calling Get properties. The impact is limited to guidance and is straightforward to correct.
Review Summary
Verdict: COMMENT
0 critical, 1 warning, 0 nits
The PR template's Summary section is still unfilled, and the description says what changed without explaining why or explicitly confirming whether this is documentation-only versus a functional API change. Please complete that section so reviewers can validate the intended behavior; CONTRIBUTING.md:56-59 asks for those details.
Fix All — prompt for AI agent
Fix the following issues in this PR:
- In
channel-manager-api/guidelines/authentication.md(line 21): clarify that the employee email is a verified authorization input supplied alongside the required Client Token, not itself an authorization token. - In the PR description: complete the Summary section with the motivation and state whether the update is documentation-only or reflects an API behavior change.
After all changes, run the project's linter/formatter.
| * **Client Token**: This token is provided by Mews and is essential for authenticating your Channel Manager application. Once we have created your integration profile, you will receive an automatic email containing your clientToken. Look for an email with the subject "Welcome to the partner community". | ||
| * **Connection Token**: This token is specific to each connection with a property. You can obtain it in four ways: | ||
| * **Using the API**: Automatic (recommended) : If your application supports [Mews: /changeNotification](../channel-manager-operations/notifications), you will receive an API notification to this endpoint when the property first connects, which contains their unique connectionToken. | ||
| * **Using the API**: Manual : If your application supports [Mews: Get properties](../mews-operations/configuration.md#get-properties), you can recover the Connection Tokens for all connections the property supports for this client application. In this case, an employee email address is used as an authorization token. |
There was a problem hiding this comment.
[warning] correctness
The employee email is not itself an authorization token. The linked Get properties contract requires both clientToken and an email, and describes the email as a verified enterprise employee address (channel-manager-api/mews-operations/configuration.md:5-7, 20-23). Calling the email an authorization token may lead integrators to put it in an auth header or omit the required client token. Describe it as an authorization input used alongside the Client Token instead.
Co-authored-by: Jonas Pauliukevičius <pauliukevicius.jonas@gmail.com>
Co-authored-by: Jonas Pauliukevičius <pauliukevicius.jonas@gmail.com>
3 participants
Clarified the process for obtaining Client and Connection Tokens, including additional methods for acquiring Connection Tokens.
Summary
Checklist
SUMMARY.mdupdated if new pages addedAPI