If I have some columns for phone numbers and email addresses listed as private (“restricted view”). Do 3rd party apps have access to this information? Same question for entire boards listed as private.
After upgrading my account to PRO I noticed when installing a new app that I noticed the following:
On Monday.com, XYZ app will be able to: Read all of your boards data
Just curious. I couldn’t find any clarification on this anywhere else.
hi @k9cloud
Welcome to the community! We have broad experience with building 3rd party apps and this is how it work from the permissions side of things.
Either the app has it’s own authentication, asking you for your credentials, or the app uses so called shortLivedTokens. If it is using it’s own authentication it depends if the user that authenticated has access to the column. If the app uses shortLivedTokones, the app runs under the credentials of the user that added the integration to your board. The user is shown in your integrations (see below)
If that user is declined to read that column (column permissions) the app won’t be able to read it to.
Hi @basdebruin,
What about 3rd party web-hook that triggers a dedicated route in the app? how could one read/write to a column in this kind of route? Does shortLivedToken can be extracted in this case as well?
Thanks in advance!
I don’t believe the post to the webhook route is signed. Best thing to do is to post to the recipe’s subscriptionUrl and wait for the post to the endpoint defined in the action. That one contains the shortLivedToken.
@basdebruin, First, thank you for your prompt reply!
Secondly, I’m not sure I was clear enough. I meant that the third party triggers a webhook that should send a POST request to a route in my app. This route needs an access token to modify a column on my board.
subscriptionUrl?I don’t think that will fly with shortLivedTokens. If the third party app initiates the flow you would need to authenticate the app. See Choosing an authentication method