Regardless of the authentication type you use (basic authentication with client credentials, authentication with OAuth2, or authentication with OpenID Connect), the Pismo platform enables you to give a third party access to a restricted set of Pismo endpoints that they can use within your organization.

For example, you could give a company access to only those endpoints that are included in the group pismo-v2:bankaccounts:rw. This would enable them to authenticate with the Pismo platform, but they would only get access to the endpoints for reading and writing to bank accounts.

By restricting third parties to just the endpoints they need to do their job, you improve your security and limit your liability.

🚧

You should never give a third party full access to the Pismo APIs.

Setting up third-party authentication

The way you can set up third-party authentication depends on the type of server authentication you've chosen. Refer to the applicable section for instructions.

Third-party authentication with Basic or OAuth2 authentication

Every organization on the Pismo platform has an org ID that you can use to authenticate with the Pismo platform. To give a third party restricted access to your organization, you must open a ticket with the Pismo Service Desk requesting that the security team provide access for a party that works only for specific endpoints. Normally, you would specify the endpoints by indicating one or more access groups.

🚧

You should never allow different third parties to use the same org ID, even if they are accessing the same subset of endpoints. Request a separate ID for each party instead. This way, you can always tell which party originated a request.

Third-party authentication with OpenID Connect

OIDC authentication uses permission groups to control access to Pismo API endpoints. Through these permission groups, you can give a third party access to only a specific set of endpoints within your organization. You create OIDC configurations in Control Center. For more information, refer to the Control Center OpenID Connect guide.

📘

Note that the third party needs to be able to generate JWTs, as described in Generate your JWT. Also, the JWT generated for this authentication must have a unique value for the aud claim. This is how the Pismo platform can tell that a request comes from a third party, not the direct client.

Once third-party authentication is configured, your third party can access the specified endpoints using the procedure described in Authentication with OpenID Connect.