Answers.Body: <p>My thoughts:</p>
  <ol>
  <li><p>Username/password that the user provides is likely the safest.  However it obviously requires the user to remember their credentials, or have some sort of password manager.  Of course you'd be relying on https to secure the user's credentials.  However, if a compromise occurs, it's only for one user, not the entire system (like API key).</p>
  </li>
  <li><p>An API key is specific for each user.  Therefore you'd likely end up with one &quot;super user&quot; that has an API key, and that key is stored in your app.  Bad idea.</p>
  </li>
  <li><p>JSON Web Token seems promising, however I have yet to find documentation on how you obtain it.</p>
  </li>
  <li><p>OAuth tokens may be the most secure, however the user experience is probably the most awkward.</p>
  </li>
  </ol>
  <p>I would use #1 for a mobile app.</p>
  <p>I would use #2 for a website you control that &quot;talks&quot; to Civi.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2022-09-13T22:07:37.257Z
Answers.LastActivityDate: 2022-09-13T22:07:37.257Z
Answers.UserDisplayName: Mmm
Body: <p>Goal is to enable constituents to login and check their status in CiviCRM from a mobile app. Question is how to best implement the authentication from the mobile app?</p>
  <ul>
  <li>One options seems to be using the <a href="https://docs.civicrm.org/dev/en/latest/framework/authx/" rel="nofollow noreferrer">authx extension</a>, having multiple types of
  credentials (username/password, API key, JSON Web Token), but not
  OAuth.</li>
  <li>Other option could be the <a href="https://docs.civicrm.org/sysadmin/en/latest/setup/oauth/" rel="nofollow noreferrer">oauth-client extension</a>, since it has
  <a href="https://lab.civicrm.org/dev/core/-/issues/2181" rel="nofollow noreferrer">per-user OAuth2 tokens</a> implemented.</li>
  </ul>
  <p>Which is the recommended way, or both option could work?</p>
  
Tags: <mobile><oauth>
Title: How to implement authentication from a mobile app to CiviCRM?
ThreadText: # How to implement authentication from a mobile app to CiviCRM?
  
  (Asked by: username_0 on 2022-08-24)
  
  Goal is to enable constituents to login and check their status in CiviCRM from a mobile app. Question is how to best implement the authentication from the mobile app?
  
  * One options seems to be using the [authx extension](https://docs.civicrm.org/dev/en/latest/framework/authx/), having multiple types of
    credentials (username/password, API key, JSON Web Token), but not
    OAuth.
  * Other option could be the [oauth-client extension](https://docs.civicrm.org/sysadmin/en/latest/setup/oauth/), since it has
    [per-user OAuth2 tokens](https://lab.civicrm.org/dev/core/-/issues/2181) implemented.
  
  Which is the recommended way, or both option could work?
  
  **Tags:** mobile, oauth
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2022-09-13. Score: 1
  
  My thoughts:
  
  1. Username/password that the user provides is likely the safest. However it obviously requires the user to remember their credentials, or have some sort of password manager. Of course you'd be relying on https to secure the user's credentials. However, if a compromise occurs, it's only for one user, not the entire system (like API key).
  2. An API key is specific for each user. Therefore you'd likely end up with one "super user" that has an API key, and that key is stored in your app. Bad idea.
  3. JSON Web Token seems promising, however I have yet to find documentation on how you obtain it.
  4. OAuth tokens may be the most secure, however the user experience is probably the most awkward.
  
  I would use #1 for a mobile app.
  
  I would use #2 for a website you control that "talks" to Civi.
  
  
  ---
  
  