Authentication

AppAPI introduces a distinct method of authentication for external apps. This authentication relies on a shared secret between Nextcloud and the external app.

Authentication flow

  1. ExApp sends a request to Nextcloud

  2. Nextcloud passes request to AppAPI

  3. AppAPI validates request (see authentication flow in details)

  4. Request is accepted/rejected

Authentication headers

Each ExApp request to secured API with AppAPIAuth must contain the following headers:

  1. AA-VERSION - minimal version of the AppAPI

  2. EX-APP-ID- ID of the ExApp

  3. EX-APP-VERSION - version of the ExApp

  4. AUTHORIZATION-APP-API - base64 encoded userid:secret

Authentication flow in details

AppAPIAuth

AppAPI provides an AppAPIAuth attribute with middleware to validate requests from ExApps. In your API controllers, you can use it as a PHP attribute.

AppAPI session keys

After successful authentication, AppAPI sets the app_api session key to true.

$this->session->set('app_api', true);