Integrating sensitive data from a data provider into instances of third-party applications executed on user devices
Certain aspects involve facilitating the integration of sensitive data from a data provider into an instance of a web-based, third-party application. For example, a data provider service can receive an authentication API call from a third-party system. The authentication API call can include a user identifier and a request for an access token usable by a web-based interface of the third-party system. The data provider service can generate an access token for the third-party system from which the authentication API call is received. The data provider service can subsequently receive, from the user device, a feature API call including the access token and a feature request for sensitive data. The data provider service can generate output data specific to the user identified by the access token included in the feature API call. The data provider service can provide the output to the user device via the web-based interface.
1. A system comprising:
a telecommunications network server comprising:
a processor,
a network communications port configured for being controlled by the processor and for communicating, via a data network, with a third-party system and a user device, and
a non-transitory computer-readable storage device included in or communicatively coupled to the telecommunication network server, the non-transitory computer-readable storage device comprising (i) a data provider service with a data provider application program interface (“API”), (ii) a data structure storing user data records with information about a user, and (iii) instructions that are executable by the processor to:
receive, via the network communications port and from the third-party system, an authentication API call addressed to an authentication endpoint of the data provider API, the authentication API call requesting an access token usable by a web-based application controlled by the third-party system,
determine, from a user identifier included in the authentication API call and that identifies the user, that the user is authorized to access one or more features of the data provider service,
generate the access token, wherein the access token is associated with the user identifier,
configure the network communications port to transmit the access token to the third-party system,
receive, via the network communications port and from the user device, a feature API call generated by an instance of the web-based application executed at the user device, the feature API call addressed to a feature endpoint of the data provider API,
generate, based on the feature API call including the access token and requesting performance of the one or more features, user-specific output data from the user data records by performing the one or more features, and
configure the network communications port to transmit the user-specific output data to the user device in a format displayable by the instance of the web-based application.
2. The system of claim 1 , wherein the instructions are further executable by the processor to generate the user identifier by performing, prior to a receipt of the authentication API call, operations comprising:
receiving, via the network communications port and from the third-party system, an enrollment API call addressed to an enrollment endpoint of the data provider API, the enrollment API call requesting that the user be authorized to access the data provider service;
verifying an identity of the user based on (i) authentication data included in the enrollment API call and (ii) at least some of the information about the user from the user data records;
generating the user identifier; and
configuring the network communications port to transmit the user identifier to the third-party system.
3. The system of claim 2 , wherein the enrollment API call further includes data authorizing the user to access an additional feature available from the data provider service.
4. The system of claim 1 , wherein the instructions are further executable by the processor to:
verify that the access token has not expired;
determine that the access token is associated with the user identifier; and
verify that the user identifier is associated with an authorization for the one or more features.
5. The system of claim 1 , wherein the instructions are further executable by the processor to:
determine that an additional user identifier included in an additional authentication API call does not match any user data record stored in the data structure; and
responsive to determining that the additional user identifier does not match any user data record, configure the network communications port to transmit, to the third-party system, an error indicating a failure to authenticate an additional user associated with the additional user identifier.
6. The system of claim 1 , wherein the processor is configured to determine that the user is authorized to access one or more features of the data provider service by performing operations comprising:
determining a requested feature included in the authentication API call; and
determining that the requested feature is in a set of enrolled features associated with the user identifier.
7. The system of claim 1 , wherein:
the authentication API call identifies a scope of operation of the data provider service,
the one or more features are within the scope of operation, and
the feature API call indicates that the access token has the scope of operation.
8. The system of claim 1 , wherein generating the user-specific output data is responsive to determining that the one or more features are within a scope of operation associated with the access token.
9. A method comprising operations executed by one or more processing devices, the operations including:
receiving, by a data provider service and via a data provider application program interface (“API”), an authentication API call addressed to an authentication endpoint of the data provider API, the authentication API call requesting an access token usable by a web-based application controlled by a third-party system from which the authentication API call is received;
determining, from a user identifier in the authentication API call that identifies a user, that the user is authorized to access one or more features of the data provider service;
generating the access token and associating the access token with the user identifier;
transmitting the access token to the third-party system;
receiving, by the data provider service and from a user device, a feature API call generated by an instance of the web-based application executed at the user device, the feature API call addressed to a feature endpoint of the data provider API;
generating, based on the feature API call including the access token and requesting performance of the one or more features, user-specific output data from one or more user data records by performing the one or more features; and
transmitting the user-specific output data to the user device in a format displayable by the instance of the web-based application.
10. The method of claim 9 , the operations further including generating the user identifier by performing, prior to a receipt of the authentication API call, additional operations comprising:
receiving, from the third-party system, an enrollment API call addressed to an enrollment endpoint of the data provider API, the enrollment API call requesting that the user be authorized to access the data provider service;
verifying an identity of the user based on (i) authentication data included in the enrollment API call and (ii) information about the user from the user data records;
generating the user identifier; and
transmitting the user identifier to the third-party system.
11. The method of claim 9 , the operations further including:
verifying that the access token has not expired;
determining that the access token is associated with the user identifier; and
verifying that the user identifier is associated with an authorization for the one or more features.
12. The method of claim 9 , the operations further including:
determining that an additional user identifier included in an additional authentication API call does not match any user data record; and
responsive to determining that the additional user identifier does not match any user data record, transmitting, to the third-party system, an error indicating a failure to authenticate an additional user associated with the additional user identifier.
13. The method of claim 9 , wherein determining that the user is authorized to access one or more features of the data provider service includes:
determining a requested feature included in the authentication API call; and
determining that the requested feature is in a set of enrolled features associated with the user identifier.
14. The method of claim 9 , wherein:
the authentication API call identifies a scope of operation of the data provider service,
the one or more features are within the scope of operation, and
the feature API call indicates that the access token has the scope of operation.
15. A non-transitory computer-readable medium embodying program code for integrating authenticated user-specific output in a web-based application controlled by a third-party system, the program code comprising instructions which, when executed by a processor, cause the processor to perform operations including:
receiving, by a data provider service with an application program interface (“API”) and from the third-party system, an authentication API call addressed to an authentication endpoint of the data provider API, the authentication API call requesting an access token usable by a web-based application controlled by the third-party system;
determining, from a user identifier included in the authentication API call and that identifies a user, that the user is authorized to access one or more features of the data provider service;
generating the access token, wherein the access token is associated with the user identifier;
transmitting the access token to the third-party system;
receiving, by the data provider service and from a user device, a feature API call generated by an instance of the web-based application executed at the user device, the feature API call addressed to a feature endpoint of the data provider API;
generating, based on the feature API call including the access token and requesting performance of the one or more features, user-specific output data from one or more user data records by performing the one or more features; and
transmitting the user-specific output data to the user device in a format displayable by the instance of the web-based application.
16. The non-transitory computer-readable medium of claim 15 , the operations further including generating the user identifier by performing, prior to a receipt of the authentication API call, additional operations comprising:
receiving, from the third-party system, an enrollment API call addressed to an enrollment endpoint of the data provider API, the enrollment API call requesting that the user be authorized to access the data provider service;
verifying an identity of the user based on (i) authentication data included in the enrollment API call and (ii) information about the user from the user data records;
generating the user identifier; and
transmitting the user identifier to the third-party system.
17. The non-transitory computer-readable medium of claim 15 , the operations further including:
verifying that the access token has not expired;
determining that the access token is associated with the user identifier; and
verifying that the user identifier is associated with an authorization for the one or more features.
18. The non-transitory computer-readable medium of claim 15 , the operations further including:
determining that an additional user identifier included in an additional authentication API call does not match any user data record; and
responsive to determining that the additional user identifier does not match any user data record, transmitting, to the third-party system, an error indicating a failure to authenticate an additional user associated with the additional user identifier.
19. The non-transitory computer-readable medium of claim 15 , wherein determining that the user is authorized to access one or more features of the data provider service includes:
determining a requested feature included in the authentication API call; and
determining that the requested feature is in a set of enrolled features associated with the user identifier.
20. The non-transitory computer-readable medium of claim 15 , wherein generating the user-specific output data is responsive to determining that the one or more features are within an operation scope associated with the access token.