API access: your own programs read your data
Your website shows the next events, a spreadsheet adds up the month, a screen in the hall lists what is on. Without this, someone copies it all by hand. With API access each of those programs gets a key of its own and reads what you allow, and nothing more.
- Open API access in your organisation's menu and tap New key.
- Say what it is for (such as "The website") and tick what it may read. Under each tick the page says what is given out and what is kept back.
- If you have branches, choose the whole organisation or one branch. Choose how long it works: until you switch it off, 90 days, or one year.
- Tap Make the key. Copy the key now and give it to the person who looks after that program. It is shown only this once.
- The page shows when each key was last used and how often. Switch off stops a key at once.
A key reads. Nothing can be changed or deleted with it.
Forms on your own website (sending in): a key can also be allowed to send in three things, each of which waits for a person: requests to join (from a "Join us" form; each waits until you approve it, as with your join link), messages (from a "Contact us" form; they arrive with your website messages), and newsletter sign-ups (the person must confirm by email first). You tick these apart under What may it send in?; a key never sends anything in unless you ticked it. Each key may send in at most 10 a minute and 500 a day, and everything sent in is written into your activity log.
Before you put such a form on your website: tell people on the form where their details go, and let them agree. The program must send that they agreed (consent), or the request is refused. Requests to join are taken only while your join link is open, and newsletter sign-ups only while sign-up is open.
What a key can be allowed to read: about us, members, committees, branches, the members' directory, meetings, events, the noticeboard, tasks, projects, planning, money, invoices and bills, assets, the media library, newsletters, certificates, annual reports, and the figures of your reports. Also, as numbers only and without any names: the calendar (everything with a day in one list), the kinds of membership and their fees, how many came to each meeting, how many come to each event and how many places are left, the shifts that still need helpers, what each appeal has raised, the results of votes that are closed, and your policies in force. You only see the ones your organisation has.
A key for one branch reads that branch and what is under it, and nothing else. It cannot be given things that belong to the whole organisation, such as About us or the report figures.
A key that runs out stops by itself on its day, so a forgotten key does not work for ever. The admins get a notice and an email a week before: make a new key and put it into the program in time.
What is never given out: notes about a member, birthdays and home addresses; the link and the code of an online meeting; anything of a member whose details were erased; events, projects and plans you have not published; the note on a task; what an asset is worth and who holds it; who subscribes to a newsletter; the pictures of an album; the tables of a report that name people; drafts of invoices and a customer's address.
For the person who connects the program: the bottom of the page shows the address, an example, what can be asked for, and the limits (60 requests a minute for each key, up to 100 rows a page).
Treat a key like a password. A key that reads members gives out personal details: give it only to a program you trust, and say so in your privacy notice. If a key may have got into the wrong hands, switch it off and make a new one. A key that was switched off cannot be switched on again.
Try it with your own organisation
Free for up to 100 members, for as long as you like. No card, no sales call.