It’s even making me think you can put the API Key in the password field:
I am not sure, if you want to do a teams we can play around with it. In all transparency I have never tried v2 in excel so I am not coming at this with any experience.
No, no, no. You’re SaaS. Do you really want anonymous access to your system? 
Usernames and Password - or better an ID Token - identify who is calling. The API-Key provides finer control on what you can do (authorization) after authenticating.
Passing the API Key in on a URL “works” but is not ideal since the call is generally logged somewhere.
Do you use Active Directory? That might be able to solve your authentication problem if the user already has a session token for Kinetic. I think you would then use Organization authentication…but I’ve never tried it.
2 Likes
Love it Mark, I will look at ways to use AD and also how to use a key vault
I assume you mean for the API-Key? Don’t get me wrong, Key Vault is good for holding API-Keys and other secrets but if the client can just grab it, then…
Right now, the only solution I know of is to write an API which then calls Epicor. The API-Key is handled by the backend and you passthough authentication from the front end.
1 Like
it’s x-api-key
Correction:
Organization authentication does not work yet.
So only basic authentication only.
2 Likes
We use AD but not connected to Epicor. I think I get it now. I really don’t want anon access, but some post said to try setting that first then modifying the code. I kind of thought that the API was security enough, but I see what you mean, the API doesn’t say anything about who is asking for the data. I thought that was the point, but I guess I am wrong.
The goal of using an API only datasource to pull data is to avoid using up a license or seat for a user that is only pulling data down for display purposes. In the past I had setup an odata connection and provided my username and password. This returns data just fine, but there is an issue with automation.
I left that datasource setup in the background, and linked it to something that would pull the data every day. The problem is that the day my password expires, I will get a message that I am already locked out. This is because the odata source was trying to pull data over an over with my (now expired) credentials. This forced epicor to lock me out and I had to get someone to reset my PW for me.
What should I be doing instead?
I got it working with Rest v2, but I don’t remember what I did.
1 Like
It’s x-api-key when provided in the header. In the query URL it is api-key.
Pray tell!?
I only know the way to do this is to switch off api keys.
So it is interesting how you hacked it. May be it should be fixed to not allow it 
I see, yeah I was thinking so they didn’t have to use the API key value itself in the excel connection you could put it in a vault.
But that doesn’t make much sense cause you would be authenticating to get to the vault using AD so at that point why wouldn’t you just use AD to authenticate with the epicor rest call.
Epicor has a license type for that called, unironically, a Web Service license. There are some limits on the frequency you call it though. Otherwise, people would buy just one license and run all of Kinetic through it. 
In User Account entry, you can create an Integration Account for this. Create a Scope and associate it with an API-KEY and the Integration Account checkbox gets checked (or you have to check it, don’t recall). Play around with that instead of using a person’s credentials - which is not good for…reasons.
4 Likes
Thank you Mark! I think this sounds like the right way. I will work on it and let everyone know!
…
I don’t think I did anything weird. Some setting in excel.
2 Likes
I’m in the middle of a bunch of fiber and wireless install, I’ll futz with Excel when I can pay attention.
Yes, inquiring minds would like to know. We have a request here to use Excel to pull BAQ data but stuck since we can’t use REST v2 in Excel.
2 Likes
I followed Marks ideas and I setup a new user called OJEXWebService. Once I set the access scope to the BAQ that I want, it automatically setup the Integration Account stuff for me. Next I had to activate that user, which sent the password to my email. Finally, I went to excel, and added a webdata source. I pasted my v2 REST string with the api included, and choose basic authentication. In the username I put the PJEXWebService username, and the temp password that was emailed to me.
This worked! I can now see some data in Excel! I will have to toy with it a bit to get it in the right format, but I think this is working correctly. @Olga am I breaking things this way?
1 Like