Question

How can an application check if the user has the correct key? certificate and validate those requirements against those in the xero api? my current algorithm only checks the accessibility of what is required in-order to make an initial connection to the api but doesn’t necessarily check that information is valid.

//check for files/keys before running xero
function provideXeroConnection($request = 'xml'){
    //validate everything is inplace
    if(validateXeroAuth()){
        //if it is then bubble the object up to (XeroAc & JSONEngine or XMLEngine)
        return new Xero(XeroAuths::getSetting('xero_consumer'), XeroAuths::getSetting('xero_secret'), XERO_PUBLIC_KEY_PATH, XERO_PRIVATE_KEY_PATH, $request );
    } else return false;
/*
* @TODO validate xero authentication
*/
function validateXeroAuth(){
    $xero_key = XeroAuths::getSetting('xero_consumer');
    $xero_secret = XeroAuths::getSetting('xero_secret');
    if(file_exists(XERO_PUBLIC_KEY_PATH) && file_exists(XERO_PRIVATE_KEY_PATH)){
        if(validateValue($xero_key) && validateValue($xero_secret)){
            return true; //feature not completely implemented @TODO
        } else return false;
    } else return false;
}
//validate the value for xero
function validateValue($value){
    if(isset($value)){
        if(!is_null($value)){
            if(!empty($value)){
                return true;
            } else return false;
        } else return false;
    } else return false;
}

The script in use is opensource and is available at github here. I’ve also read the example implementation of the script here. But I haven’t really found anything for a quick authentication.

The reason I’m asking this.. is I’d much rather have my users keys and certificates authenticated in a couple of seconds rather than minutes (give and take how many invoices or contact information has to be recieved). Any help on this issue would be much appreciated! 🙂

Answer 1

The quick answer to your question is to do a GET Organisation call – if that fails with a 401, you know you have done something wrong.

The long answer is: are you sure you should be using a private API application if you are getting users to authenticate? There are other application types that may be better suited to this scenario (I’ve made some assumptions so I may be wrong). This might help: API Application type guide.