Provider-scoped endpoints - Prequel

Provider-scoped endpoints can be used from a client app with a short-lived scoped auth token instead of your API key.

Generate a token

From your backend, call the Generate Scoped Auth Token endpoint with the origin of your client app and the Provider ID. The returned scoped_token is valid for one hour.

Generate scoped auth token

curl --request POST https://api.prequel.co/import/actions/generate-scoped-auth-token \
  --header "X-API-KEY: <api_key>" \
  --header "Content-Type: application/json" \
  --data '{
    "application_origin": "https://app.acme.com",
    "provider_id": "3fa85f64-5717-4562-b3fc-2c963f66afa6"
  }'

To call Create provider source or Test new provider source, also include the source in the token request. Those requests must send the same source.

Call an endpoint

List provider sources

curl https://api.prequel.co/import/providers/3fa85f64-5717-4562-b3fc-2c963f66afa6/sources \
  --header "Authorization: Bearer <scoped_token>" \
  --header "X-APP-ID: acme-import" \
  --header "Origin: https://app.acme.com"

X-APP-ID is any single identifier for your client app, with no spaces. The React SDK sends third-party-client.
Origin is set by the browser. Its hostname must match the hostname of application_origin. Browser requests also require that origin on your organization’s CORS allowlist.
The provider_id in the path must match the token.