Authentication
Choose how users will securely connect your plugin to external services.
No Auth
When to use: APIs that require no login or for public data.
Security level: Low.
Recommended for: Non-sensitive, open APIs.
Basic Auth
What it is:
Basic Authentication is a simple method where the client sends a username/password or an API key along with each API request. These credentials are combined into a single string, then Base64-encoded before being sent in the request header.
What it will do:
When a user connects via Basic Auth, viaSocket will securely store their provided credentials and attach them to every request made to your API. This ensures the API recognizes and authorizes the user or application making the call.
Key points:
Works well for internal services, quick testing, or APIs with simple authentication needs.
Not encrypted by itself — credentials are only Base64-encoded. Always use HTTPS to protect them in transit.
Less secure than OAuth 2.0 for production use, but faster to implement.
Step-by-step configuration will be covered in another guide.
OAuth 2.0
What it is:
OAuth 2.0 is an industry-standard, secure authorization protocol that allows users to connect your plugin to their accounts without sharing their credentials directly. Instead of storing a username/password, the user grants permission via a secure consent screen, and your system receives an access token for making API calls.
What it will do:
When a user connects via OAuth 2.0, viaSocket will handle:
Redirecting the user to the provider’s consent screen.
Receiving an authorization code or access token from the provider.
Securely storing tokens.
Automatically refreshing tokens when they expire (if refresh tokens are provided).
Why it’s recommended:
High security — credentials aren’t exposed to your app.
Granular permissions — tokens can be scoped to specific actions/data.
Automatic token refresh — avoids manual re-authentication.
Common Grant Types in OAuth 2.0:
Grant Type | Best For | Notes |
|---|---|---|
Authorization Code Guide | Web apps with backend (secure tokens) | Includes refresh token logic |
Implicit Guide | Browser apps without refresh token access | Less secure; tokens exposed in URL. |
Client Credentials Guide | App-to-app secure access | No user intervention required |
Password Credentials Guide | Legacy setups needing direct login | Deprecated in most modern deployments |
Each grant includes: Fields setup, redirect/auth endpoints, token/refresh/revoke API, Test (ME) API, Auth Identifier, Connection Label, and Request Params.
Authentication Type | Use Case | Security Level | Recommended For |
|---|---|---|---|
No Auth | Public APIs, non-sensitive data | Low | Open data access |
Basic Auth | Internal services, quick testing | Medium | Internal applications, prototyping |
OAuth 2.0 | Third-party integrations, secure access | High | Most modern applications |
Common Authentication FAQs
Q: When should I avoid Basic Auth?
→ Use Basic only for internal or secure environments. Prefer OAuth when possible.
Q: My Auth fails—what now?
→ Check correct redirect URI, grant type, and ensure tokens refresh correctly. Expose errors clearly in Test API logs.
Q: Are tokens encrypted?
→ viaSocket stores encrypted tokens securely; tokens refresh automatically when configured.
