New Beta: New API authentication methods, endpoints, and public API docs

[SeanKeenan]

Hi everyone,

For those I haven’t met, I’m Sean, an engineer on the Airtable API team.

Today our team is excited to announce the public beta (it’s public – so no need to sign up!) of several new API authentication features to make our API more secure for all our users. Bundled with them are the (long-requested!) metadata API, comments API, and webhook API.

And one more feature (my personal favorite): a new publicly accessible API docs site to learn about all of these in more exciting detail! Airtable Web API

• API authentication: personal access tokens
  • Use personal access tokens for more granular control over access to bases and workspaces: https://airtable.com/create/tokens.
• API authentication: OAuth for Integrations
  • Register an integration to build using OAuth 2.0: https://airtable.com/create/oauth.
  • Users can authorize third-party integrations with OAuth for a secure setup and granular controls.
• New API endpoints
  • As part of either of the authentication methods above, we have several new API endpoints and functionality, including the metadata API - please read our changelog for more info on these endpoints. Airtable Web API
• Enterprise Admin features
  • Enterprise admins can create service accounts that can utilize both of the new API authentication methods and associated API endpoints described above. This feature will help ensure continuity for scripts and integrations.
  • Admins will also be able to restrict whether and which OAuth third-party integrations can be used in their enterprises.

Additionally, we plan to announce a deprecation timeline for user API keys when these more secure authentication methods (personal access tokens and OAuth integrations) graduate from public beta to general availability. Per our deprecation guidelines, there will be a notice period of at least 12 months (from the date of that future announcement) before the deprecation is enforced.

This public beta is just the beginning! We plan on continuing to add new features and update existing ones based on your feedback.

Learn more from our updated API docs and then try it for yourself — and, if you have any questions, don’t hesitate to ask here,

Sean, on behalf of the Airtable API Team

[Will_Powelson]

Hi @Artur_Mkrtchya1, sorry you're having trouble!

we are getting the following error message:

> You have reached the maximum access authorizations for this integration. You cannot authorize this integration again until you revoke at least one of the authorizations

---

We limit the number of active tokens per (user, OAuth integration) pair to 20. We do not limit the number of users who can authorize a single OAuth integration.

To alleviate this issue you will need to revoke some of your existing tokens from the integrations menu (accessible by clicking your user profile from the homescreen).

---

 is there an endpoint to pass the token and retrieve the auth scopes ? something like token info that googlesheet and others have ?

---

Yes, you can see the scopes and the userId of the user who authorized the token by pinging
https://api.airtable.com/v0/meta/whoami
with your access token.

I'll update the docs to make both these answers clearer.

[Artur_Mkrtchya1]

Thanks a lot @Will_Powelson 

Re: https://api.airtable.com/v0/meta/whoami is there a way to know if specific base was selected or a future bases in a workspace ?

And regarding table creation API could you share why formula and lookup fields are not supported and if there is a chance we can get it sometime soon ?

[Will_Powelson]

---

Re: https://api.airtable.com/v0/meta/whoami is there a way to know if specific base was selected or a future bases in a workspace ? 

Not at this time. If this is a feature you'd like, it would help us if you explained your use case. The more sample use cases we know of, the easier it is to prioritize new features.

And regarding table creation API could you share why formula and lookup fields are not supported and if there is a chance we can get it sometime soon ?

---

I'll defer to Fred's earlier comment, to summarize: these features are more work to implement than is obvious (if I could do this over a weekend I would!) and we're unable to prioritize them right now. Sadly, I'm not in a position to offer any timelines for when these might be prioritized. 

[Artur_Mkrtchya1]

@Will_Powelson thanks a lot for getting back to me.

Re: https://api.airtable.com/v0/meta/whoami endpoint it enables us to see usrId a) we would like to show user's email so they know they created OAuth Integration with given email and also enable them to see what bases and workspaces they enabled access... Right now we almost not have a useful info from this endpoint to use to be honest. Knowing user Artur enabled Access to BaseA, BaseB or workspaceA certain scopes would be very useful for user's own understanding within third party apps. 

[Will_Powelson]

@Artur_Mkrtchya1 Thank you for the feedback, we've heard something similar from other developers and would like to address the issue. Unfortunately we're unable to simply "hand out" this data due to legal reasons (it's personally identifiable information) so it will take a little more work on the backend e.g. adding new scopes. I doubt we can address this before the end of the beta but I will try to make forward progress.

[LeanZubrezki]

@Will_Powelson is there an estimation of when the new API will be out of beta? Are any big changes expected?

[Daniel_Levine]

Hi all,

Today our team is excited to share that these new API features are now in GA! It's been great to hear the feedback we've received during public beta about our new API Auth methods making our API more secure (Personal Access Tokens and OAuth), as well as new capabilities including the metadata API, webhook API, and comments API.

We're also announcing the start of the API Keys deprecation period, which will last for 12 months and end on Feb 1, 2024, after which API Keys will no longer be able to access the Airtable API. We recommend all users to migrate to Personal Access Tokens for individual use and OAuth for third-party integrations moving forward.

For more details and any questions, please see this community post announcing the API Capabilities now in GA and upcoming API keys deprecation period.

Thank you!

Daniel, on behalf of the Airtable Team

[Greg_F]

Hi @SeanKeenan and @Daniel_Levine 

FYI there can be legitimate use cases to connect Airtable data using mobile  -  the Oauth screen is clearly insisting on the desktop era 😉