APIs require authentication to control access to their endpoints. GenerativeAgent’s API connections support the following authentication methods:

  • Basic Authentication (username/password)
  • Custom Header Authentication (API keys)
  • OAuth 2.0 (Authorization Code and Client Credentials flows)

If your APIs require an authentication flow that is not supported by the default authentication methods, we can create a custom authentication method for you.

​
Create an Authentication Method

To Create an Authentication Method:

1

Navigate to API Integration Hub > Authentication Methods

You may also create an Authentication Method when specifying the API Connection’s API Source.
2

Click 'Create Authentication Method'

3

Configure the Authentication Method

  • Provide a name and description
  • Select the Authentication Type matching your API’s requirements
  • Configure the type-specific settings detailed in sections below
  • Save the Authentication Method
4

Add to API Connection

In the API Connection’s API Source tab, select this Authentication Method for Sandbox or Production environments.

​
Basic Authentication

Basic authentication requires:

  • Username
  • Password

​
Custom Header

Custom headers add authentication data to API requests via HTTP headers. Common implementations include API keys and bearer tokens.

To configure a custom header, you need to:

  1. Optionally enable client authentication:
    • Enable if you need to reference values from the client in a header.
    • Set the client data validity duration.
    • Reference client data using {Auth.*}
  2. Header configuration:
    • Header Name (e.g., “Authorization”, “X-API-Key”)
    • Header Value (static value or dynamic client data)
      • e.g. {Auth.client_token}

​
OAuth

OAuth 2.0 provides delegated authorization flows. GenerativeAgent supports:

Required configuration:

  • Authorization Code reference

    This is the location within the client data that contains the authorization code.

    {Auth.authorization_code}

  • Client ID

  • Client secret

  • Token Request URL

  • Redirect URI

    You can use a variable from the client data for the redirect URI. {Auth.redirect_uri}

  • How the client authentication data is passed

    • Basic Auth, or
    • Request Body

  • One or more headers to be added to the request.

    • Header Name

    • Header Value

      Use {OAuth.access_token} for the generated access token.

      You can also reference the client data in the header values, using the variable: {Auth.[auth_data_key]}.

​
Client Authentication Data

Some authentication flows require dynamic data from the client:

  • OAuth authorization codes
  • User-specific API keys
  • Custom tokens

Client authentication data is provided through:

If you are using GenerativeAgent independently of ASAPP Messaging, this Auth data is passed via the /authenticate endpoint.

​
Client Authentication Session

Any authentication method that requires client data will store the auth data for the session.

If the underlying API returns a 401, we will require new client authentication data for the session. This is communicated in the GenerativeAgent event stream as an authenticationRequested event.

​
Custom Authentication Methods

If your API requires an authentication flow not supported by our default methods, we can work with you to create a custom solution.

Contact your ASAPP account team to discuss your custom authentication requirements. We’ll work with you to build and implement the solution.

​
Using Custom Authentication Methods

Custom authentication methods work the same way as standard methods:

  • They appear in your authentication method list
  • Can be selected when configuring API connections
  • Support both sandbox and production environments

Custom authentication methods are read-only configurations. To modify an existing custom authentication method, please work with your ASAPP account team.