Access Control

Access Control allows you to control where an API Token can be used and which Smartflo APIs it can access. These restrictions provide an additional layer of security and help ensure that a token is used only for its intended purpose.

Smartflo provides two access-control options for portal-generated API Tokens:

• IP Restriction – Controls the IP addresses from which the token can be used.
• Scope Restriction – Controls the Smartflo APIs that can be accessed using the token.

You can enable either restriction independently or use both together for stronger access control.

IP Restriction

IP Restriction allows you to restrict an API Token so that API requests are accepted only when they originate from the configured IP addresses. This is particularly useful when an application or server has a known and fixed public IP address.

When IP Restriction is enabled for a portal-generated token, you can configure the allowed IP addresses using one of the following options:

• Select Predefined IPs – Use this option when the required IP address is already configured in the Smartflo account's IP Pool. Select the appropriate IP Pool from the available list.
• Define New IPs – Use this option when the IP address required for the token is not already available in the predefined IPs. Enter the IP address from which the token should be allowed to access Smartflo APIs.

IP Restriction is recommended when:

• The application runs from a fixed public IP.
• API requests originate from known servers.
• You want to prevent the token from being used from unauthorized locations.
• The integration is running in a controlled production environment.

Scope Restriction

Scope Restriction allows you to control which Smartflo APIs can be accessed using an API Token. When Scope Restriction is enabled, you can select only the APIs or API categories required by the application instead of providing unrestricted API access.

Based on the configured API access, the available scopes include:

• Dialer
• Broadcast
• ClickToCall
• Call Options

The Call Options scope provides additional API-level permissions, including:

• Live/Active Calls
• Call Operations – Monitor, Whisper, Transfer, Barge
• Call Detail Reports (CDR)
• Call Hangup

This allows you to provide an application with access only to the specific functionality it requires.

Combining IP and Scope Restrictions

For stronger security, both IP Restriction and Scope Restriction can be enabled on the same token.

In this configuration:

• IP Restriction controls where the token can be used.
• Scope Restriction controls what APIs the token can access.

Example

A customer's production CRM:

• Sends API requests only from 203.0.113.10.
• Requires only ClickToCall APIs.

The token can be configured as:

This ensures that the token is limited to the required API access and can only be used from the authorized IP address.

Portal Token vs API-Generated Token

Although both token types can be used to authenticate Smartflo API requests, their generation method and access-control behavior are different.

Portal-generated API Tokens provide configurable expiry and token-level access controls, while API-generated authentication tokens have a default validity of 1 hour and follow the access restrictions of the user whose credentials are used to generate the token.

Use the comparison below to understand the key differences.