Question

It appears that you have to use a licensed account in order to initiate a transaction with the api. There seems like there should be a better way of getting a stable token. The reason I'm asking this is because you wind up having to expose one of your account passwords in your code if you want to have the api function from inside one of your projects.

It also seems like a problem passing an unencrypted username and password in the clear in a url string.

Have I missed something here or is this really the way the api is implemented?

UPDATE: Ok, so it looks like the api wants to play fast and loose with one of my accounts. That just seems like a poor design to me. How about this as a feature request:

Let an administrator create a semi-permanent token inside the FogBugz admin tools. Don't allow that token to be used as a normal login, but instead let it provide credentials through the api. Allow the admin to create a non-license requiring name to be associated with token like "MyProject Website" or "API Generated".

The token can then be used by the project to submit api calls. If it gets compromised, the administrator could change it and let the developers know they need to modify their code to reflect the new token. It would be nice if a toke was generated automatically upon creating a new project. A global token unassociated with a project would be nice, too, but not as necessary.

What do you think?

Answer 1

• You don't need to store the username and password in your code to get a new token with cmd=logon every time. You can get the token once and put that in your code instead of the username and password.

• If you are concerned about transmitting passwords in the clear, you can configure your site to use https, but that's not unique to the API.

See also this post on token persistence.