Authentication and installation permissions

Caraer supports app-scoped API access and OAuth authorization. An app installation identifies a company and its granted permissions. Record and property permissions govern what that integration can actually read or change.

Why integrate

You can offer a customer-authorized connection to Caraer, with permission requirements tied to the integration’s task. Installer-selected settings can determine which objects your integration needs instead of requesting access to every object in the company.

What you could build

A customer installs your app, chooses the object to process, and grants the corresponding access. Your backend then reads those records and writes its results using the installation’s company context. An OAuth-enabled private app can also be used to test endpoints in the interactive API reference.

Start integrating

Follow API authentication and app permissions. Keep the separate flow for connecting an app to an external OAuth provider in mind when your integration also needs credentials for another service.

Use the current installation permissions as the access contract. Knowing a record UUID does not grant access, and an empty installation grant denies access. Private apps belong to their owning company. Keep private credentials on your backend and use the appropriate public endpoints for browser forms or published website content.