Connected App best practices

Developer Support APIs & Integrations
1

Hello, i’m wondering what are the best practices for connected apps.

I have an app which is public, domain verified but i don’t want it to be listed in the marketplace and is not private.

We are using the app to access our user’s HS Crm account, ie pulls contacts and more.

Today this is my workflow:

  1. Any user in our system, can install the app
  2. Once the app in installed i have their individual tokens
  3. I access in their behalf the crm resources

Problem with this approach:

  • Every user needs to install/connect the app for me to get their individual tokens and HS userId

Alternative approach

  • Only 1 super admin needs to install/connect the app
  • Once the app in installed i have 1 individual tokens (of the super admin)
  • For all other users i will access all HS resources on super admin’s behalf, instead of that specific user executing the action.

Cons of the alternative approach:

When i use CRM cards, HS connects to my system with a userId, since that running userId may have never install/connected the app, i won’t have the mapping to my internal userId, thus i don’t know who the user is and hence i cannot execute certain actions.

What is the recommended approach?

Thank you!!

2

Hi, @kdicenta :waving_hand: Thanks for reaching out. Hey, @louischausse @Teun @miljkovicmisa @Mike_Eastwood, do you have any thoughts on best practices here? Based on your experience.

Thank you very much! — Jaycee

3

Hi @kdicenta

We have “public” apps, that anyone can install, that are not listed in the markeplace (long story).

When someone authorises the app (OAuth) we store the Portal ID and use that for account management, permissions, etc..

When a CRM Card makes a call to our API the json has the Portal ID and the user’s details which can be used for logic in your app.

Sorry if this was a bit vague – happy to chat over Zoom to find out more details.

Have fun

Mike

p.s. thank you for the mention @Jaycee_Lewis