Apps
OAuth applications that connect to Superposition on a customer's behalf.
An app is an OAuth application that another organization can authorize to reach their Superposition data. If you are building a product that integrates with Superposition for your own customers, this is the surface you want.
If you only need to reach your own organization's data from a script or a CI job, you do not need an app — use an API key. It is less work and there is nothing to authorize.
Building an app
Create it, pick the scopes it asks for, and get a client id and secret.
Authorizing an app
What happens when someone connects an app, and how to disconnect it.
The shape of it
An app acts as the person who authorized it, inside the organization they chose. It does not get its own standing access to their account, and it can never do more than that person can: if their role is reduced, the app's reach narrows with it; if they leave the organization, the app stops working there.
That is the trade Superposition makes deliberately. An app's access is tied to a real person, which means it is revocable by that person, visible in their authorized-apps list, and attributed to them in the audit log.
Two ways an app can act
| Acts as | Use it for | |
|---|---|---|
| Authorization code | The person who authorized it | Anything on a customer's behalf. |
| Client credentials | The app itself | Background jobs with no user involved. |
Client-credentials access is off unless an organization admin turns it on for your app and chooses its scopes, and it is capped at what an ordinary member can do — so it can never read the audit log or billing, whatever is selected.
Last updated on