API Authentication and Implementation Constraints

This section provides additional clarity on how authentication works in StrategicERP APIs and outlines the technical constraints to consider during implementation.

1. API Authentication – How to Obtain Login, Password, or API Key

StrategicERP APIs require authenticated access. The credentials needed for API calls can be obtained through the following methods:

a. ERP → Admin → API Integration / API Generator

The system administrator can navigate to:

Admin Module → API Integration / API Generator

From this screen, the administrator can:

• Create or view the API user account
   

• Generate the API username and password
   

• Generate an API Key or Token (if enabled)
   

• Configure allowed forms and field mappings
   

If this menu is not visible, it must be enabled by the cloud administrator or StrategicERP Support.

b. Use of a Dedicated Integration User

For integrations, it is recommended to create a dedicated API user rather than reusing a personal login.
The administrator provides:

• API Username
   

• API Password
   

• Cloud Code
   

• API Endpoints (Test and Production)
   

c. When Credentials Are Not Accessible

If the API credentials are not visible in the Admin module, contact:

• Your Cloud Administrator
   

• StrategicERP Support
   

Request the following:

• API username/password or API key
   

• Authentication method (Basic Authentication / Token-based)
   

• Test and Production API URLs
   

• Any IP whitelisting requirements
   

2. How Authentication Works

StrategicERP supports the following authentication mechanisms, depending on the configuration:

a. Basic Authentication

Credentials (username and password) are passed in the API request header.

b. Token / API Key Authentication

A token or key is generated and added to the request header, for example:

Authorization: Bearer <API_KEY>

Token-based authentication is preferred for security and easier credential rotation.

3. Implementation Constraints

The following technical constraints must be considered when implementing API integrations with StrategicERP.

A. Endpoint and Environment Constraints

1. Use the Test Server for validation before switching to Production.
    

2. Test and Production URLs are different and must be used appropriately.
    

3. Some deployments require IP whitelisting for external systems.
    

B. Payload and Field Mapping Constraints

1. JSON keys must match the exact names expected by the receiving system.
    

2. Map ERP fields to JSON structure clearly before development.
    

3. Keep payloads minimal and avoid sending unnecessary data.
    

C. Authentication Constraints

1. Only API-enabled users can make API calls.
    

2. Credentials should not be hardcoded; use secure storage.
    

3. Token-based credentials should be rotated periodically.
    

4. Session expiry or token expiry may apply, depending on configuration.
    

D. Rate Limits and Performance Constraints

1. API calls may be restricted in volume; confirm rate limits with the administrator.
    

2. Large data transfers should be processed in batches.
    

3. Implement retry logic for transient errors.
    

E. Error Handling and Reliability Constraints

1. Capture and log success and error responses for troubleshooting.
    

2. Implement:
    

   • Retry mechanisms
      

   • Timeout handling
      

   • Idempotency using unique identifiers to avoid duplicate processing
      

F. Security Constraints

1. Always use HTTPS for API communication.
    

2. Do not send sensitive or personal data unless required.
    

3. Mask credentials and sensitive data in logs.
    

4. Validate all incoming and outgoing data formats.
    

G. Testing Constraints

1. All integrations must be tested thoroughly on the Test Server.
    

2. Document JSON request and response schemas.
    

3. Maintain version control of API contracts.
    

4. Summary 

Authentication
API credentials (username/password or API key) must be obtained from:
Admin → API Integration / API Generator
or requested from the cloud admin or StrategicERP Support.

Constraints

• Use Test Server first; Production endpoints differ.
   

• JSON field names must match the configured mapping.
   

• Securely store API credentials.
   

• IP whitelisting may be required.
   

• Implement retries, timeouts, and duplicate-prevention logic.
   

• Use HTTPS and avoid unnecessary data transmission.