Goal is to enable constituents to login and check their status in CiviCRM from a mobile app. Question is how to best implement the authentication from the mobile app?

Which is the recommended way, or both option could work?

1 Answer 1


My thoughts:

  1. Username/password that the user provides is likely the safest. However it obviously requires the user to remember their credentials, or have some sort of password manager. Of course you'd be relying on https to secure the user's credentials. However, if a compromise occurs, it's only for one user, not the entire system (like API key).

  2. An API key is specific for each user. Therefore you'd likely end up with one "super user" that has an API key, and that key is stored in your app. Bad idea.

  3. JSON Web Token seems promising, however I have yet to find documentation on how you obtain it.

  4. OAuth tokens may be the most secure, however the user experience is probably the most awkward.

I would use #1 for a mobile app.

I would use #2 for a website you control that "talks" to Civi.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.