Possible Hosted Version
scottrobertson opened this issue · comments
So... i have been thinking about how we can have a hosted version of this app so that webhooks can easily be setup for Monzo and Starling users. 1 major criteria is that we do not store any access tokens etc. This is mainly because i just don't want to have to deal with the security of YNAB data, and also because I don't think YNAB would like this.
What we could do is allow people to send their YNAB access token in with the webhook, similar to how we do it with ynab_account_id. So for example, they would setup their webhook URL to be:
https://hosted.app/monzo?ynab_access_token=blah&ynab_account_id=blah
That way we are not storing any access tokens at all, but it allows for super easy setup for people.
Any suggestions? Questions? Concerns? Is this a stupid idea?
Its an interesting idea, but the tokens don't expire so it's as good as having the keys to the kingdom. I suspect eventually they open it up to allow others to "use" your application " The Monzo Developer API is not suitable for building public applications." it will be possible, and that will be the correct way to do it.
Personally, I'd wait :)
@rossdargan to be clear, we would not store any Monzo tokens at all.
Wouldn't the YNAB tokens end up in all the logs if passed in via GET? As far as I can tell that's about all that would happen as far as tokens being retrievable from anywhere. Worst case scenario if logs are breached, someone's YNAB ends up with a ton of random data in it / missing.
It would certainly be an easy way to setup webhooks while keeping up to date with the app code, I'd happily use it.
To be honest, I would feel comfortable storing the ynab tokens and logging in via oAuth.
Would users then be able to just select thier YNAB bank account id's via the hosted version? Set the Monzo one and the Starling one via the hosted app?
I assume users could then just set the webhooks to hosted.app/user-id-thing/monzo unless you plan on checking where the webhooks come from? Then determine if monzo or starling
@ganey Would probably encode an access token, ynab account id, and source (monzo, starling etc) in the webhook url.
I need some beta testers :D
I'll happily test
@ganey can you send me an email at scottymeuk @ gmail and i will get back to you :)
Closing this, as it's inbound very soon.
And it's been approved! https://syncforynab.com