In the midst of building an API for Intervals, our web-based project management software, we researched several options for authentication. In case you are considering building your own API, we’ve published an overview of each method below.

1. HTTP Basic Authentication.
   Similar implementations: Basecamp (http://developer.37signals.com/basecamp/), blogger (deprecated) (http://code.blogger.com/archives/atom-docs.html#authentication)
   Requests are authenticated in the form of the user’s username and password. Very easy to implement. Low security, but can be reinforced through the use of SSL/TLS (available on top three plan tiers). Users can disable API access from third-party apps at any time by changing their username or password.
2. HTTP Token Authentication
   Similar implementations: Freshbooks (http://developers.freshbooks.com/), Highrise (http://developer.37signals.com/highrise/)
   Requests are authenticated through a token. Each user possesses a unique token, retrievable on that user’s settings page. Rather than entering username/password information, users just key in their token. Also very easy to implement. Low security, but requires a more active role from the user. Security can also be reinforced through SSL/TLS (available on top three plan tiers). The token is a hash of the username and password, meaning users can enable or disable API access from third-party apps at any time by changing either. With this implementation and the ones following, users never have to hand over login credentials to third-party applications.
3. Three-Legged Authentication
   Similar implementations: Facebook Connect (http://wiki.developers.facebook.com/index.php/Authenticating_Users_with_Facebook_Connect), Yahoo! BBAuth (http://developer.yahoo.com/auth/), Google AuthSub (http://code.google.com/apis/gdata/auth.html#AuthSub)
   In this approach, each developer registers for an API key. Requests are authenticated through the developer’s API key and a user token. A token is retrieved when the API application redirects the user to a secure Intervals login page. After the user grants access to the API application, the API application retrieves the token. High security, but harder to implement. Also, a browser is required to grant authorization (though just once). May be overkill for developers building in-house applications. Users can disable API access per application by revoking access.
4. Three-Legged Authentication with Request Signing
   Similar implementations: flickr (http://www.flickr.com/services/api/auth.spec.html), OAuth (http://oauth.net/core/1.0/#anchor9), Twitter (uses OAuth: http://apiwiki.twitter.com/OAuth-FAQ), Google OAuth (uses OAuth: http://code.google.com/apis/gdata/auth.html#OAuth), Yahoo! BBAuth
   Identical to #3, except API developers select a secret password when they register for an API key, and use this password to sign all requests. If any requests are intercepted, no modified requests can be made unless signed by the password known only to the developer and Intervals. Very high security (though not impenetrable), but more difficult to implement. May be overkill for developers building in-house apps. Options 3 and 4 can be implemented simultaneously with the decision to sign requests left up to each API application developer.

Related posts

• What’s next for Intervals? – Intervals Roadmap Update (1)
• Stringing along programs and APIs? (0)

Task Flexibility

Estimated launch: Next Few Weeks

We are starting the process of making tasks less rigid to accommodate different types of work flows. End date is now optional for ongoing projects. Tasks are going to be given a very similar treatment. Assignee and due date are going to be optional instead of required. If you use Intervals for development this will allow you to create a backlog module and assign tasks without a due date or person responsible. When you are ready to put the task into motion it can be edited and assigned to a member of your team. Multiple assignees and task templates are also coming down the pipeline.

We are contemplating recurring tasks. It would not be “true” recurring tasks, but more like spawning a new task based on recurring rules. Say for example you have a weekly IT task for “Backup Rotation” you could set it as a weekly task that never ends. When you close this week’s task, next week’s task is automatically created.

Visit the forum to weigh in on Recurring Tasks

Milestone Management and Calendar View

Estimated launch: August/September 2008

Internally we have been calling this “the missing piece of the puzzle”. The ability to see everything going on via a calendar and attach tasks to milestones is coming soon. The home page will be transformed into a calendar view — a scheduling dashboard — tying together tasks starting, tasks ending, milestones, and weekly time tracked. The calendar view will allow you to quickly reorganize tasks and milestones by dragging and dropping them. The ultimate goal of this Dashboard home page view is to give you an insightful overview into what’s happening now in Intervals (and to be able to filter the information by client, project, person, etc.).

Here is a sneak peak on how milestones will be integrated into Intervals (click on each thumbnail to view actual size).

Visit the forum to weigh in on Milestones

Email Polling

Estimated launch: August 2008

The work request queue is ideal for your clients to submit their requests, however it currently requires you to create an executive login. Email polling will let you specify a POP3 email account that Intervals will check on a regular basis, importing any new emails into the request queue and adding the attachment as a document. Email polling will also make it easier for your clients to submit work requests simply by sending them to an email address of your choosing.

Email polling is the first step toward full email integration in Intervals. And it is one of the many upcoming enhancements that will enable you to interact with your data outside the context of a web browser.

Visit the forum to weigh in on Email Polling

Desktop Widgets

Estimated launch: Q4 2008

Although Intervals excels as a hosted time tracking and task management service, a web-based tool has its shortcomings when you want to quickly manipulate time and task entries without firing up your favorite web browser. We’ll be introducing a widget for simple time tracking, and a more comprehensive widget for managing tasks and time.

Visit the forum to weigh in on the Desktop Widget

QuickBooks Export

Estimated launch: Q4 2008

Many of you, including us, use QuickBooks for small business accounting. Invoices, payments, expenses, and time tracking data will all be exportable to QuickBooks, eliminating the hassle of double entering data.

Visit the forum to weigh in on the QuickBooks Export

API

Estimated launch: Q4 2008

For those of you wanting to get at your data in its rawest form, the API will get you the unfiltered data you need. Using any method of your choice (we prefer Curl) you will be able to query Intervals with customized XML requests. Use the API to build your own reports or build widgets for the desktop; the possibilities of what you can do with the API are infinite.

Visit the forum to weigh in on the API

We are constantly tuning and optimizing Intervals to enhance your online experience. Your feedback is very important to us on our productivity journey together. Thank you again for taking the time to express your ideas and give us feedback.

This list is not exhaustive by any stretch and we have a lot more items in the works. If you have questions about other features that may or may not be on the roadmap, please let us know.

Related posts

• Online Time Tracking & Task Management Using Intervals Mini (1)
• Intervals Online Time, Task & Project Management Improvements (0)
• Intervals Web-based Mobile App Beta Launch (0)
• Intervals Online Project Management Software Review (0)
• New Intervals Features Launched (0)

Some will argue that the availability of APIs allows you to seamlessly string together these various applications into a package that is a perfect fit for our business. The problem with that is most small business owners are focused on running a business. They don’t have the time, or the technical expertise, to establish an archipelago of web-based productivity applications.

As we’ve developed Intervals, we’ve discovered many small businesses like our own; companies struggling to find one application that does just enough, but not too much, and offers a workflow proven to be effective by other small businesses.

Our experience as small business owners, and invaluable feedback from our customers, has helped us to continue perfecting the Intervals workflow. We embrace the idea that process is one of community, and that Intervals is a tool for gaining new perspective and intelligence from our personal business data. Intervals would benefit greatly from an API, and we do plan on implementing one soon.

Related posts

• Growing a Profitable Small Business (0)
• Unsexy and Profitable Businesses ~ More Observations From SXSWi (3)
• Reducing Energy Consumption as a Small Business (1)
• Why Outsourcing Your Small Business Responsibilities is a Bad Idea (2)
• Getting Started Marketing Your Small Business Through Online Social Media (0)