# Is it possible to perform RPC calls using user application authentication?
**URL:** https://discuss.tryton.org/t/is-it-possible-to-perform-rpc-calls-using-user-application-authentication/844
**Category:** Developer
**Created:** [November 1, 2018, 9:41am UTC](https://discuss.tryton.org/t/is-it-possible-to-perform-rpc-calls-using-user-application-authentication/844 "2018-11-01T09:41:20Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@fmorato](https://discuss.tryton.org/u/fmorato)
#### Post date: [November 1, 2018, 9:41am UTC](https://discuss.tryton.org/t/is-it-possible-to-perform-rpc-calls-using-user-application-authentication/844/1 "2018-11-01T09:41:20Z")
I would like to avoid maintaining an API for certain application using user\_application. Is it possible to use Tryton’s RPC interface using user\_application?
---
### Author:  [@ced](https://discuss.tryton.org/u/ced)
#### Post date: [November 1, 2018, 10:31am UTC](https://discuss.tryton.org/t/is-it-possible-to-perform-rpc-calls-using-user-application-authentication/844/2 "2018-11-01T10:31:24Z")
No, the `_dispatch` method (responsible for all RPC calls) is decorated by `@app.auth_required` this decorator support only session and login/password type of authentication.
I do not think it will be good to add support for `user_application` because this will give full access to any API to the owner of the `user_application` key which is aimed to be given to third party.
---
### Author:  [@fmorato](https://discuss.tryton.org/u/fmorato)
#### Post date: [November 1, 2018, 10:52am UTC](https://discuss.tryton.org/t/is-it-possible-to-perform-rpc-calls-using-user-application-authentication/844/3 "2018-11-01T10:52:52Z")
> [@ced](#):
>
> I do not think it will be good to add support for `user_application` because this will give full access
Indeed not good.
> [@ced](#):
>
> aimed to be given to third party.
But in order to be given an `user_application` key, it requires the third party to have an user account and manually activate it through the user preferences.
So the third party already has full API access.
From the [user\_application](http://docs.tryton.org/projects/trytond/en/latest/topics/user_application.html) docs:
> After the creation, the key must be validated by the user from the preferences of a Tryton client.
---
### Author:  [@ced](https://discuss.tryton.org/u/ced)
#### Post date: [November 1, 2018, 11:06am UTC](https://discuss.tryton.org/t/is-it-possible-to-perform-rpc-calls-using-user-application-authentication/844/4 "2018-11-01T11:06:24Z")
> [@fmorato](#):
>
> But in order to be given an `user_application` key, it requires the third party to have an user account and manually activate it through the user preferences.
>
> So the third party already has full API access.
No, the third party make a request to create a key and then the corresponding user validate the request in his profile. So the third party does not need to have login access.
---
### Author:  [@fmorato](https://discuss.tryton.org/u/fmorato)
#### Post date: [November 1, 2018, 11:29am UTC](https://discuss.tryton.org/t/is-it-possible-to-perform-rpc-calls-using-user-application-authentication/844/5 "2018-11-01T11:29:08Z")
I am trying to understand the use cases and workflow of how `user_application` is used.
At first I thought that this feature is for internal use so that employees can access functionality through an specified application. But now I’m not sure how a third party fits into the scenario.
So, for example: `employee37` gives his username for third party to request a key to access the application.
Or is `employee37` supposed to create a new user in the system for the third party and give only the username so that they can request a key and `employee37` would then activate the key for the third party.
---
### Author:  [@ced](https://discuss.tryton.org/u/ced)
#### Post date: [November 1, 2018, 2:28pm UTC](https://discuss.tryton.org/t/is-it-possible-to-perform-rpc-calls-using-user-application-authentication/844/6 "2018-11-01T14:28:06Z")
> [@fmorato](#):
>
> So, for example: `employee37` gives his username for third party to request a key to access the application.
Yes but only for the specific application name which is linked to a specific API (only route decorated by user\_application of the same name).
> [@fmorato](#):
>
> Or is `employee37` supposed to create a new user in the system for the third party and give only the username so that they can request a key and `employee37` would then activate the key for the third party.
No, user should not create new user for third application. You must see it like when you register third application to your Twitter or Facebook account.
The first user application is [Chronos](http://www.tryton.org/download#chronos), it is deeply linked with the user-employee as it create time-sheet for him and it can only use the timesheet user\_application (see timesheet/routes.py).
---
### Author:  [@fmorato](https://discuss.tryton.org/u/fmorato)
#### Post date: [November 1, 2018, 3:28pm UTC](https://discuss.tryton.org/t/is-it-possible-to-perform-rpc-calls-using-user-application-authentication/844/7 "2018-11-01T15:28:29Z")
Thank you for the more detailed explanation.
---
### Author:  [@system](https://discuss.tryton.org/u/system)
#### Post date: [December 1, 2018, 3:28pm UTC](https://discuss.tryton.org/t/is-it-possible-to-perform-rpc-calls-using-user-application-authentication/844/8 "2018-12-01T15:28:32Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.