Token authentication for API integration

On this page

Introduction

As an administrator, it is imperative that you maintain the highest level of security within your organization while simultaneously allowing the most efficient process integration to be enabled. To allow for this balance, SolarWinds Service Desk (SWSD) provides token-based authentication that encrypts your credentials and enhances security across the organization while enabling the use of APIs.

Tokens can only be viewed by the user (administrator) who created the token. You (creator) can also regenerate the token using the same UI.

Factors to consider

• Only someone with an SWSD admin license can generate an API token.

• SolarWinds recommends tokens should be associated only by administrators with full application access. Any issued token shares the same permissions as the specific user’s role; when user permissions change after a token is issued, the token's permissions also change.

• If a token is reset or deleted, the API connection associated with the specific token is broken, and the associated script/process integration will need to be corrected.

• Users can ONLY create and view tokens associated to themselves. No one can generate tokens for others, or reference other users' tokens.

• If the user who generated the token is disabled, the token is also disabled.

• There is no impact on current username/password API authentication. This feature does not impact users currently utilizing username/password authentication. However, for security reasons, token generation is highly recommended, as Username/password authentication requires heavier maintenance depending on your organization's password reset policy. SolarWinds suggests planning a transition process to update your current API connections if necessary, moving to the token format.

• Using token-based authentication enhances security to both your API scripts and the process integrations feature.

• API documentation is available at the API Documentation site).

Set up token authentication

1. Navigate to Setup > Users & Groups > Users and locate your User detail page (not your User Profile Card). You can also use the search bar to go directly to your user and click on your name for details.
2. From the user detail page, click Actions and select Generate JSON Web Token from the dropdown menu. (SWSD administrator rights required.)
3. In the user detail page under JSON Web Token you can see the following options:
   • Copy. Copy the token to your clipboard.
   • Reset. Reset your token.
   • Delete. Delete your Token.
   • Hide Token. Minimize your token, and replaces with a Show Token link.
4. Click Copy.

Use the token for API scripting

The example below displays how to insert your Token for authentication in API Scripting:

Example for CURL:

-H 'Accept: application/vnd.samanage.v1.1+json' -H 'Content-Type: application/json' -X GET https://api.samanage.com/incidents.json

For information on where to add the token in the CURL command, see SolarWinds Service Desk API.

Use the token for Process integration

• Navigate to Setup > Integrations > Process Integrations.

• Add a new, or edit an existing integration, and modify the Authentication Method to SolarWinds Service Desk Web Token.