2. Obtaining access

Procedure for issuing an API token and registering a “Sign in with QAIRU” application.

2.1. API token

API tokens are issued by the university administration. When a token is issued, the list of available modules and the validity period are defined, and where necessary also the permitted number of requests per minute, the list of permitted IP addresses and the list of available Alem models.

To obtain a token, an organization submits a request to the university stating its name, the purpose of using the API and the list of required modules. Contact details are provided on the “Contacts” page.

The token value is provided to the recipient once and is not provided again. If a token is lost or compromised, the university must be contacted without delay to revoke it and issue a new token.

2.2. Registering a “Sign in with QAIRU” application

Applications are registered by the university administration. The request states the name of the application, its purpose, the website address, the redirect addresses redirect_uri and the list of modules to which the application requires access.

Upon registration the developer receives the client identifier client_id of the form ext-<name>, the client secret client_secret, and the discovery, authorization and token addresses.

a redirect address is specified in full and compared exactly, without wildcard characters;
only https:// addresses are permitted; http://localhost is permitted for debugging;
the list of modules of the application limits the scopes it can request from a student.

The client secret is provided once. If it is lost, the university administration issues a new secret, after which the previous one ceases to be valid.