API Authentication

Overview

You can use the API to send and receive data from TilliT, allowing you to integrate other solutions with TilliT. To ensure your endpoint is secure, every request is authenticated over a HTTPS connection with either a Basic or Bearer Token Authorization header. To start, you will need to setup an account. The API cannot use Single Sign On (SSO), so you must create an account in TilliT.

Create a Service Account in TilliT

1

With an existing account, navgate to Users -> Manage -> Actions -> Create

2

Fill out the form with the following, where EMAIL should be a secure company email and user groups and site should be assigned to all those applicable. Do not use a personal email for your API User.

3

You will receive an email to confirm your account, follow the steps to create the password you will use to authenticate with.

Authenticating your Requests

Using the service account, you will need to create the appropriate Authorization header. Choose either BASIC or BEARER authentication methods.

BASIC Authentication

Basic authentication is a simple authentication scheme built into the HTTP protocol. The client sends HTTP requests with the Authorization header that contains the word Basic word followed by a space and a base64-encoded string username:password. For example, to authorize as demo / p@55w0rd the client would send

Authorization:Basic ZGVtbzpwQDU1dzByZA==
	

Note: Because base64 is easily decoded, Basic authentication should only be used together with other security mechanisms such as HTTPS/SSL. 
Swagger.io - https://swagger.io/docs/specification/authentication/basic-authentication/

1

To apply the above knowledge to TilliT, it is important to know that a TilliT username is compose via the following, replacing username and tenant.

{username}@{tenant}.tillit.cloud
	

2

We can easily create our base64-encoded string using the following command in a terminal window

echo 'username@tenant.tillit.cloud:password' | base64
	

3

Using the result from this command, we can now complete our first request to the TilliT API and retrieve all sites

curl -H 'Authorization:Basic <ENCODED_TEXT>' https://tillit.cloud/api/core/sites
	

BEARER Authentication

Bearer authentication (also called token authentication) is an HTTP authentication scheme that involves security tokens called bearer tokens. The name “Bearer authentication” can be understood as “give access to the bearer of this token.” The bearer token is a cryptic string, usually generated by the server in response to a login request. The client must send this token in the Authorization header when making requests to protected resources:

Authorization:Bearer <token><br>
	

The Bearer authentication scheme was originally created as part of OAuth 2.0 in RFC 6750, but is sometimes also used on its own. Similarly to Basic authentication, Bearer authentication should only be used over HTTPS (SSL).
Swagger.io - https://swagger.io/docs/specification/authentication/bearer-authentication/ 

Next: Swagger Docs