API Authentication and Implementation Constraints

This section provides additional clarity on how authentication works in StrategicERP APIs and outlines the technical and procedural constraints to be considered during implementation.

1. API Authentication – How to Obtain Login, Password, or API Key

StrategicERP APIs require authenticated access. The credentials needed for API calls depend on whose API is being integrated and can be obtained through the following methods:

a. StrategicERP API Credentials

When the integration involves StrategicERP’s own APIs, the credentials will be provided by StrategicERP.

The system administrator can navigate to:
Admin Module → API Integration / API Generator

From this screen, the administrator can:

• Create or view the API user account
   

• Generate the API username and password
   

• Generate an API Key or Token (if enabled)
   

• Configure allowed forms and field mappings
   

If this menu is not visible, it must be enabled by the Cloud Administrator or StrategicERP Support.

In cases where StrategicERP APIs are used, StrategicERP will share the required API username and password for integration.

b. Third-Party / External API Credentials

If the integration involves a third-party or external system’s API, then:

• The external system owner will share:
   

  • API Username
     

  • API Password or API Key
     

  • Authentication method
     

  • API Endpoints
     

When integrating somebody else’s API, the responsibility of sharing the username and password / API credentials lies with the respective third-party system.

c. Use of a Dedicated Integration User

For all integrations, it is recommended to create a dedicated API user, instead of using personal login credentials.

The administrator should provide:

• API Username
   

• API Password / Token
   

• Cloud Code
   

• API Endpoints (Test and Production)
   

d. When Credentials Are Not Accessible

If API credentials are not visible in the Admin module, contact:

• Cloud Administrator
   

• StrategicERP Support
   

Request the following:

• API username/password or API key
   

• Authentication method (Basic / Token-based)
   

• Test and Production API URLs
   

• IP whitelisting requirements (if any)
   

2. How Authentication Works

StrategicERP supports the following authentication mechanisms, depending on configuration:

a. Basic Authentication

• Username and password are passed in the API request header.
   

b. Token / API Key Authentication

• A token or API key is generated and passed in the request header, for example:
  Authorization: Bearer <API_KEY>
   

Token-based authentication is preferred due to better security and easier credential rotation.

3. Implementation Constraints

The following technical constraints must be considered during API integration:

A. Endpoint and Environment Constraints

• Test Server must be used before Production.
   

• Test and Production URLs are different.
   

• Some deployments require IP whitelisting.
   

B. Payload and Field Mapping Constraints

• JSON keys must exactly match expected field names.
   

• ERP fields must be mapped clearly before development.
   

• Avoid sending unnecessary data.
   

C. Authentication Constraints

• Only API-enabled users can access APIs.
   

• Credentials must not be hardcoded.
   

• Token credentials should be rotated periodically.
   

• Session or token expiry may apply.
   

D. Rate Limits and Performance Constraints

• API call limits may apply.
   

• Large datasets should be processed in batches.
   

• Retry logic should be implemented for transient failures.
   

E. Error Handling and Reliability Constraints

• Log all success and error responses.
   

• Implement:
   

  • Retry mechanisms
     

  • Timeout handling
     

  • Idempotency using unique identifiers
     

F. Security Constraints

• Use HTTPS for all API calls.
   

• Avoid transmitting sensitive data unless required.
   

• Mask credentials in logs.
   

• Validate all request and response formats.
   

G. Testing Constraints

• All integrations must be tested on the Test Server.
   

• JSON request and response schemas must be documented.
   

• Maintain version control of API contracts.
   

4. Summary

Authentication

• StrategicERP APIs: Credentials will be shared by StrategicERP.
   

• Third-party APIs: Credentials will be shared by the respective external system.
   

• Credentials are obtained from:
   

  • Admin → API Integration / API Generator
     

  • Or via Cloud Administrator / StrategicERP Support
     

Constraints

• Always test on Test Server before Production.
   

• Ensure exact JSON field mapping.
   

• Securely store credentials.
   

• IP whitelisting may be required.
   

• Implement retries, timeouts, and duplicate-prevention logic.
   

• Use HTTPS and minimize data transmission.