# Security Approach For Consuming Gitea APIs

**URL:** <https://forum.gitea.com/t/security-approach-for-consuming-gitea-apis/3474>\
**Category:** API/SDK/Tea/HelmChart/Terraform\
**Created:** [July 7, 2021, 7:01pm UTC](https://forum.gitea.com/t/security-approach-for-consuming-gitea-apis/3474 "2021-07-07T19:01:00Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![vwDel](https://avatars.discourse-cdn.com/v4/letter/v/aeb1de/32.png) [@vwDel](https://forum.gitea.com/u/vwDel)\
**Post date:** [July 7, 2021, 7:01pm UTC](https://forum.gitea.com/t/security-approach-for-consuming-gitea-apis/3474/1 "2021-07-07T19:01:00Z")

</div>

It is advised that using Gitea APIs for customization. It seems to be better to have another web application as a client of Gitea APIs for any customization functionalities. One way to handle the security is to obtain a security token first by calling …/api/v1/users//tokens and use the token for any following API calls. To do so, the client application needs to know the user credentials of the Gitea. A simple way to achieve the goal is that the user credentials for the client application are the same for the Gitea.

Any better alternative approaches if there is a user administration management system out there?

---

<div class="post-metadata">

**Author:** ![techknowlogick](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.gitea.com/techknowlogick/32/4706_2.png) [@techknowlogick](https://forum.gitea.com/u/techknowlogick)\
**Post date:** [July 10, 2021, 1:24am UTC](https://forum.gitea.com/t/security-approach-for-consuming-gitea-apis/3474/2 "2021-07-10T01:24:05Z")

</div>

If you have another web application attempting to consume Gitea APIs it is recommended you use OAuth2: [OAuth2 provider - Docs](https://docs.gitea.io/en-us/oauth2-provider/)