Create API Maker Accounts from Your Own Code: The Management API for SaaS

Intro

0:00 Create accounts from your own code. One call from your sign-up system makes an admin account of API Maker, with its Git repository pulled, its secret saved and a deployment hook. Nobody in the panel.

Onboarding, by hand

0:14 Onboarding a customer by hand means root signs in and adds the account, sets its Git repository and pulls it, writes its secret, and makes its deployment hook, for every customer. With the API of API Maker, your sign-up system makes the account in one call : its repository pulled, its secret saved, and the address that deploys it, in the answer. In this video : turn it on, one call, what it made, a new owner, and a new secret, an account removed, when it refuses, and how to keep it safe.

Turn it on

0:47 As root, Deployment Settings. The card API Access. Operate API Maker Using API : the address of the API appears, one address for every operation. Generate a communication token, at least forty eight characters. It is the only key of this API : keep it like a password.

One call

1:09 Save. Calm Home sells shops to partners. When Harbor Home signs up, the sign-up system of Calm Home sends one POST to that address : the token, and CREATE_ADMIN_USER. The user : the owner of the shop, and its API path. Its Git repository, made from the template of Calm Home, and its branch. And its secret, written by your code. The answer : the account, without its password, the branch pulled, the secret saved, and a deployment hook, with the address your CI calls to deploy it.

1:43 Keep that address secret.

What it made

1:46 Sofia, the owner of Harbor Home, signs in for the first time. Git Integration : her repository, main pulled a few seconds ago, and the deployment hook the call made. The custom APIs of the template are there. One secret, the one the call sent : the password of her API user, and the connection string of her own database. Every new account gets the sample shop : custom APIs, schemas, hooks.

2:13 With a repository, the pull puts the items of the branch in their place. Without one, send insertDefaultData false : only its default group, its API user and its secret are made.

A new owner, a new secret

2:26 Root sees Harbor Home among the accounts. It has a new owner : UPDATE_ADMIN_USER finds the account by its API path, and changes only what you send, here the name and the email. The same account, with its new owner. Harbor Home moves its database. UPDATE_SECRET replaces the code of its default secret : send it whole, with the same keys, or what the account encrypted with them can not be read any more, and the new connection string.

2:56 The answer is true.

An account removed

2:59 Harbor Home leaves : DELETE_ADMIN_USER, with its API path. The account is gone, with everything it owns : its APIs, its secrets, its API users, its logs. Called again, it answers false : nothing left to remove. There is no undo.

When it refuses

3:16 When the API refuses, the answer says why. 403 : it is off, or has no token. 401 : a wrong token, like an old one after you changed it. 400 : an account already has that API path. 404 : no account has it.

Keep it safe

3:35 The token is the only key : no session, no sign-in. So call the API from your backend, over HTTPS, never from a browser or an app. Keep the token with the other secrets of your backend : change it, and every program with the old one stops at once. And keep the deployment address of each account secret : whoever has it can start a deployment of that account.

The whole pattern

3:59 The whole pattern : a partner signs up. Your backend makes its repository from your template, and one call makes its account, pulls its branch and saves its secret. Its developers push to that branch, your CI calls the deployment address, and the new code is live.

Recap

4:17 To sum up. Turn it on in Deployment Settings, with a token of forty eight characters or more. One call makes an account, with its repository pulled, its secret saved and a deployment hook. By its API path, change it, change its secret, or remove it. Every refusal says why. And the token stays on your backend. Next : Git integration, and the deployment hooks your CI calls. API Maker.

4:44 Build faster, spend smarter, deliver better.