Skip to main content

​
Introduction

Web API 3 provides a new way of communicating with Cryptolens. Instead of having different access levels (where permission is given on a global level), Web API 3 provides a uniform way of authentication and authorization (please see the explanation of terms below). The access token is an additional parameter that you have to add to each request, i.e. token={accesstoken}. For example

​
Access Tokens

An access token is an easy way of identifying yourself to Cryptolens and ensuring that only a specified scope of permissions is given. You can think of access tokens as your login credentials that are restricted to a certain scope of methods (in the Web API). Here’s an example of an access token.
Use your own access-token value in requests; its name is only a descriptive label. You can manage your access tokens on the Access Token page. Note, an access token will only be shown once. There is no way of retrieving it once generated. For every control, default, and recommended configuration, see the access-token and RSA public-key guide. Your RSA public key verifies signed license data; it does not authorize API calls. Find it under Credentials on the signed-in dashboard QuickStart page, following the instructions in the guide. Please make sure that you treat each access token as your personal password. Although an access token has a restricted scope, it will be able to access products even if they are not set to IsPublic. Create an Access Token

​
Scopes

A scope is a way of telling Cryptolens what an access token is allowed to do. It allows you to specify the allowed methods in Web API 3 and if you want to restrict it to a certain product or key. Let’s look at them more in detail!

​
Method Lock

Permission checkboxes start unchecked. Select the permissions your integration needs; a token can have more than one permission. Each checkbox grants its documented operation or group of operations. For example, Extend License permits extending a license’s expiration date. Some permissions cover multiple methods, such as User Auth Admin. One token can activate and deactivate a license when both Activate and Deactivate are selected. Activate alone does not grant Deactivate. The pre-generated QuickStart token permits Activate and GetKey, but not Deactivate. The requested operation must still satisfy its other parameters and restrictions.

​
Product, Key or Feature Lock

The lock fields default to 0; Product Lock displays this as Any. They restrict permitted operations where the method supports that restriction; they do not grant method permissions.
  • Product Lock: select a product to restrict supported calls to its product ID. A value of 0 does not restrict the token to one product.
  • Key Lock: for methods that check license access, a positive value restricts access to the license’s numeric ID (GlobalId), not its license-key string. A value of 0 does not restrict access to one license. Negative values enable the Auth.KeyLock workflow: -1 generates a license-bound child token valid for one day, -2 for two days, and so on, retaining the method permissions. The separate Get Token authorization workflow uses Key Lock to limit child-token lifetime instead; follow its method-specific instructions.
  • Feature Lock: its meaning depends on the method. It restricts the feature number for AddFeature/RemoveFeature, supplies a returned-field mask for Activate/GetKey, sets trial days for CreateTrialKey, restricts the template ID for CreateKeyFromTemplate, or caps the increment amount for IncrementIntValue. A value of 0 leaves the method’s normal behavior without that token-level override.
All permissions on one token share its lock values. Use separate tokens when operations need different restrictions. Product and Key locks are not a universal filter on account-level customer, user, reseller, or payment operations; check the relevant method reference.

​
Explanation of Terms

  • Authentication - It’s a way of identifying yourself to Cryptolens, i.e. so that Cryptolens knows who is performing the request
  • Authorization - It’s a way of making sure that only the desired permission is given to something.