How to Use OAuth APIs on Levelup?

Levelup allows you to use OAuth APIs connect securely and automate tasks with other applications used in your organization.

What is OAuth API?

Simply put, OAuth APIs use the Open Authorization framework, for secure and standardized user authentication and authorization. It allows third-party applications to access the user data and services on another platform, without necessarily disclosing your credentials.

The Acceptance Criteria for Using OAuth API on Levelup

Before use OAuth API for your Levelup, here are some of the acceptance criteria that you must follow:

1. ClientID and Secret Key Generation :

• A unique ClientID must be generated and should remain constant across a single company.
• A Client Secret must be created with a predefined expiration period (6 months, 1 year, or 2
  years).

2. Storing Credentials :

• Store the Client Secret in an encrypted format in the database.
• Allow the Client Secret to be viewed a maximum of 2 times after creation. Afterward, display a masked version.

3. Steps After Expiry of Credential:

• You need to block API access if the Client Secret expires & if disabled (i.e is set at ‘active false’).
• It is recommended to set the status of expired keys as ‘Expired’ and keep them in the database for auditing purposes.

4. Notifications:

• Make sure that you send expiration reminders (e.g., 30 days, 7 days and on the date of expiry) to admins.
• Maintain a record of notifications in the database.

5. Key Update Process:

• Allow admins to regenerate the Client Secret when necessary.
• Make sure the old secret remains in the database but is marked as Disabled/Inactive.

6. Enable/Disable client ID and secret (APIs):

Under company settings add an option/flag to check if APIs option is available for the company to see.

7. Security:

• Ensure the ClientSecret is not visible in plaintext after the initial view count is exceeded.
• Use robust encryption for storing sensitive data.

The Process of Setting Up OAuth APIs on Levelup

Here are the steps that you need to follow to set up OAuth API on Levelup. Please note that you will need an admin account on Levelup to setup APIs

1. Log in to your Levelup admin account and click on the profile icon located in the top-right corner.
2. From the dropdown menu, click on Account, which opens the Account page.
3. On the Account page, you will find the OAuth APIs option listed under the Meeting Platforms card
4. Click on OAuth APIs to view settings.

Managing OAuth API Access

Please note that OAuth APIs are automatically enabled for companies on subscription plans with 200+ active users. This functionality is controlled through the company settings table in the SQL database.

You can request API access without meeting the above criteria, but in that case, the APIs can be manually enabled upon request.

OAuth APIs page

When OAuth APIs are disabled, you will see the following messages/blurb on the OAuth APIs page:

“This feature is currently not available under your current Levelup plan. Please click here to contact us to learn more about this feature.

5. Click on Click here. The following dialog box opens up

“Title – Request APIs Access

A multiline text box for entering comments with the placeholder text: “Please tell us about your API requirements.”
6. Enter your API requirements in the text box.
7. Once you are done, click on ‘Submit’
8. You can also click on submit to start the process all over again
9. Once the request has been submitted, we will book a meeting with you within 2-3 business days to discuss your requirements
10. After OAuth APIs are enabled, you will see the following on the OAuth APIs page:
“Set up a new OAuth APIs app”

You can refer to documentation and list of APIs on our Knowledge Centre.

11. If no OAuth app has been set up yet, click on “New OAuth App” to generate a client ID and secret to connect your apps to Levelup.

Creating Client Secret

12. Once the OAuth APIs have been set up. You will need to create a Client Secret
13. You will get an option “Connect securely and automate tasks with other applications used in your organization.”
14. You will get an options to copy the client ID, OAuth App and to generate new client secret. Click on the option for client secret to generate the secret.
15. You will get the following message:
        Are you sure you want to generate a new client secret? Once the secret is created, you will be able to view   and copy it only twice.”
16. You will get a dropdown menu to choose the validity period, with the following options: 3 months, 6 months, 1 year, 2 years. Choose the one that you want
17.  Click on ‘Generate’ to generate the client secret
18. You can also click on ‘Cancel’ to start the process afresh

Email Notifications on Client Secret Expiry

All Admins will receive an email regarding client secret expiring 30 days, 7 days and on the day the client secret expires.

You will find the status to be set as “Expired” beside the client secret value.