Apps acting for users beta

An app Anikeen trusts can work in the Console with the user's own Anikeen ID access token: order products for the user - who confirms and pays on Anikeen ID as usual - and manage them.

your user ── login (Anikeen ID, scope console-containers) ──▶ your app stores the token pair
your app  ── GET /app-team ──▶ the Console creates the user's team for your app
your app  ── POST /teams/{team}/orders ──▶ open order with checkout_url
your user ── confirms on Anikeen ID ──▶ webhook order.completed, later product.ready

Using Laravel?

The PHP SDK anikeen/console implements this whole flow, including the token refresh and the webhooks.

App tokens

A token issued to another OAuth client than the Console, and marked as trusted by Anikeen ID (trusted apps skip the consent screen), is an app token:

• Only the console-* scopes count. user, user:read, products:read and * do not.
• It works in one team of the user - the app's team - and sees nothing else. Other teams, their products and orders, reseller grants answer 404.
• The reseller API refuses it (401, error: client_not_allowed).
• Tokens of apps that are not trusted, and tokens without client information, are refused (401, error: client_not_allowed).
• Requests are recorded in the team's audit log as made through the API by your app.

Ask for the scopes in your Anikeen ID login, e.g. with Laravel Socialite and anikeen/id:

use Anikeen\Id\Enums\Scope;

return Socialite::driver('anikeen')
    ->scopes([Scope::CONSOLE_CONTAINERS])
    ->redirect();

The app team

Your app's first request creates its team for the user: the owner is the user, the name is your app's name. It is not the user's primary team, and there is one per user and app. Find it with:

GET /v1/app-team

{
  "data": {
    "id": "01JF…",
    "name": "Your App",
    "app": { "id": "<client id>", "name": "Your App" },
    "created_at": "…"
  }
}

Tokens that are not app tokens have no app team (404, error: no_app_team).

Ordering into the app team

Order with POST /teams/{app team}/orders like any team owner:

1. The order is open and has a checkout_url.
2. Your app sends the user there; the user confirms and pays on Anikeen ID. Nothing is charged before that.
3. Optionally pass a return_url so the user comes back to your app afterwards.
4. The order.completed webhook tells you when the order went through, and product.ready when each product is built.

The subscription belongs to the user, as with every Console order.

The app team is read-only in the Console

The user (the owner) sees the team and its products in the Console with a badge "Managed by your app" and a hint instead of the action buttons; only your app changes them, through the API:

• The team cannot be edited or deleted and has no members.
• It takes no part in product transfers (in or out) and is not offered in the Console's builder.
• The user's own tokens can read it, but cannot order for it (403, error: team_managed_by_app) or change its products (403).
• Cancelling stays possible in Anikeen ID - the subscription is the user's.
• Anikeen staff are locked out the same way (read only) unless the team's management is unlocked for them for a limited time.

None of this affects your app's own requests.

Users created by the app

When the token's user has never signed in to the Console, your app's first request creates the Console account just in time (only for app tokens with a console-* scope) from the user's Anikeen ID profile: name, e-mail, verified e-mail, and a default team like at a first login. A Console account without Anikeen ID and with the same e-mail address is linked like at a first login.

Status	error	Meaning
403	email_not_verified	the user's e-mail address is not verified in Anikeen ID
409	account_conflict	the e-mail address belongs to another Console account

Ending it

The user removes your app in Anikeen ID (Settings → Connected apps):

• Your app's tokens stop working within 5 minutes.
• The app team becomes a normal team again: editable, members allowed, no badge. Its products keep running.
• The user gets an e-mail that your app no longer manages the team.
• Your app gets its last webhook for the team, team.released.

If the user connects your app again, its next request creates a new app team; the old products stay in the released team.