We are asking third-party software vendors that integrate with Leon to connect through OAuth instead of manually created API keys. The two reasons are security and scalability, explained below.
This applies to commercial products that many operators connect to Leon, such as scheduling, maintenance, accounting or booking platforms. It does not take anything away from operators who build their own tools: manually created API keys stay available for in-house integrations.
Reason 1: Security — no keys sent by hand
With OAuth, no secret ever has to travel between people. That removes the most common way API access leaks: a key copied, forwarded and forgotten.
Today a manual key works like this. An administrator generates it in Leon under Settings → API keys, copies it and sends it to the vendor by email, ticket or chat. From then on the key sits in mailboxes, chat histories and sometimes spreadsheets. Anyone who finds it can use it, and nobody can tell where all the copies are.
With OAuth, the administrator never handles a secret. The vendor sends a link, the administrator logs in to Leon, checks the application name and the list of data it asks for, and clicks Confirm. Leon then issues credentials directly to the application. Logins through SAML SSO are supported on this page too.
Reason 2: Scalability — the vendor runs the authorization process
With OAuth, connecting and reconnecting is a built-in step of the vendor's product, not a manual exchange repeated for every operator. That matters once a vendor serves dozens of Leon operators.
With manual keys, every new customer means a separate exchange: someone creates a key, picks permissions, sends it and the vendor pastes it in. When the vendor's product needs a new permission, every operator has to create a new key and send it again. Each round costs time on both sides and is easy to get wrong.
With OAuth, the vendor owns the whole flow:
-
First connection. The operator clicks a Connect button in the vendor's application and approves access in Leon.
-
New permissions. When the vendor's product needs more data, the vendor asks the operator to authorize again. The operator sees exactly what is new and confirms in a few clicks.
-
Token renewal. The application refreshes its own access in the background, with no keys to rotate by hand.
-
Support. The vendor builds and maintains the connection, so they are the first point of contact if it stops working.
What stays the same: API keys for in-house systems
Manually created API keys are not going away. If your own team builds a tool that connects to Leon, for example an internal dashboard, a reporting script or a link to your own accounting system, you can keep using API keys.
In that case the key never leaves your organization, so the main risk OAuth solves does not apply in the same way. Administrators still create these keys under Settings → API keys, choose the permissions each key needs and describe its purpose.
We know OAuth takes more effort to set up
OAuth asks more of a developer than pasting a key into a configuration file. The application has to register with Leon, handle a redirect after login and store and refresh tokens.
For software companies this is routine. OAuth 2.0 is a widely adopted industry standard, used by most major platforms, and mature libraries exist for every common programming language. Many vendors already use it to connect to other systems, so adding Leon is a familiar task.
For small, in-house development the extra work can be a real barrier. A single developer writing a script for one operator gains little from building a full OAuth flow. That is exactly why we keep manual API keys available for systems you build yourselves.
What this means for you
|
You are |
What to do |
|---|---|
|
An operator using a third-party product connected with an API key |
Ask the vendor about their plan to move to OAuth. Once they support it, reconnect through their app and delete the old key in Settings → API keys. |
|
A software vendor integrating with Leon |
Request OAuth client credentials from Leon Support and move your customers to the OAuth flow. Test accounts with sample data are available for developing and testing it. |
|
An operator building your own integration |
No change needed. Keep using API keys created by your administrator. |
Questions about the change can be raised through the Customer Portal.
Sources
-
Third-Party Provider Integrations with Leon: Setup and Authorization Process
-
Admin Confirmation With SAML SSO in OAuth Integration Authorization