I have been asked to make a mobile app for a friends website. The website is a Multi level marketing site that sells products and franchises. A client logs in in to the website and can view his or her dashboard ( user can view team members, business volume, commissions, invoices, etc.) The app is supposed to bring the dashboard to user's mobile devices (w/ some added features).

The company does not have any APIs that deal with interaction or authentication, and I am new to the whole secure login side of app development. My questions is this, how do I let the users gain access to their information via my app from the secure website when there is no API?

  • 1
    Why the downvote? Please leave a comment so the OP can correct or improve the question. – Sundeep Jun 23 '13 at 7:50
  • 2
    Sharing your research helps everyone. Tell us what you've tried and why it didn’t meet your needs. This demonstrates that you’ve taken the time to try to help yourself, it saves us from reiterating obvious answers, and most of all it helps you get a more specific and relevant answer. Also see How to Ask – gnat Jun 24 '13 at 11:17

You'll need to understand several things to get the full picture. I'll try my best to help you understand.

They have to give you some API. The API's should take input using HTTP/S requests and give only data out in a format preferred by both(JSON/XML/CSV/other). Especially, the login part should use HTTPS so that the password and user name are not sent in plain text to the website. Once user keys in user name & password, they will be sent to server for authentication. Upon successful authentication, server should give you an authentication token or id that has a validity period(can be infinite also). After that, every request should use this authentication token. Indeed, the API should be designed that way to serve any account specific data only with an Authentication token. If the authentication token expires, then user has to login again to get a new token. This in a nutshell is the OAuth protocol(there is much more to it like clientID, client token). Google, Twitter, Facebook use this for their API.

If that site cannot give out API's, I can give you one terrible advice - Make your app work like a browser. i.e., Once you login, store the session cookie in the app and use it to request web pages. Then you scrap the web pages for the data you need and then display it in the app. Like I said, this is terrible advice, but a possibility that should be okay for minimal loads. For handling more loads/users, you should definitely go the API way.

| improve this answer | |

If you would consider using MS technology you can use ASP.Net forms authentication with SQL server. ASP will build a data structure to persist your account information. Also there will be generated content for account login or registration.

a good starting point would be MSDN: How to implement simple forms authentication

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.