I need a way to generate a temporary authentication token so that clients have access to images hosted via a 3rd party service, but I can’t send the request from the clients themselves as that would mean they have access to the secret key.
I haven’t found anything from my searches, but is there a way for the cloud server itself to send a request?
If not, does anyone have tips how I can generate temporary tokens?
Hi @bonetrail,
An app can’t make an API call from the Confluence Cloud server. You would need your own server (service or cloud function / lambda) for that.
Regards,
Dugald
Thanks!
To answer the other part of my question, you can get Connect apps have Atlassian servers send an authentication request during installation. This will let you generate the key needed to prevent 3rd parties from uploading arbitrary data while keeping user instances distinct from each other.
Here’s the documentation for more info:
https://developer.atlassian.com/cloud/confluence/security-for-connect-apps/
Hi @bonetrail,
I don’t understand your question.
get Connect apps have Atlassian servers send an authentication request during installation
What type of authentication request and where to?
When an app is installed, the Confluence server will send two requests to your app;- installed followed by enabled. You can experiment with the Connect inspector to see how this works.
Regards,
Dugald
Sorry, I should have read the full documentation.
I just needed a way to upload images to my server without 3rd parties having the ability to upload to it too. I was not aware that this you can set this up when the app is installed for the first time.
It may also help to add that I am relatively new to authentication… 
Hi @bonetrail,
No problems. You shouldn’t have to read the full documentation in order to understand fundamental aspects such as this. For this reason, I’ve created AC-2539 to improve the documentation.
Regards,
Dugald