# What should password field be?
**URL:** https://meta.discourse.org/t/what-should-password-field-be/53167
**Category:** Development
**Created:** [November 21, 2016, 12:57am UTC](https://meta.discourse.org/t/what-should-password-field-be/53167 "2016-11-21T00:57:47Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@adam\_beers](https://meta.discourse.org/u/adam_beers)
#### Post date: [November 21, 2016, 12:57am UTC](https://meta.discourse.org/t/what-should-password-field-be/53167/1 "2016-11-21T00:57:47Z")
When using the create user API call with Google Sign-In, what should the password field be when sending the POST command? The Google Sign-In doesn’t actually return a password, so what should be used?
---
### Author:  [@adam\_beers](https://meta.discourse.org/u/adam_beers)
#### Post date: [November 24, 2016, 3:20am UTC](https://meta.discourse.org/t/what-should-password-field-be/53167/2 "2016-11-24T03:20:01Z")
Nobody has any ideas?
---
### Author:  [@vinothkannans](https://meta.discourse.org/u/vinothkannans)
#### Post date: [November 24, 2016, 4:32am UTC](https://meta.discourse.org/t/what-should-password-field-be/53167/3 "2016-11-24T04:32:28Z")
Are you using user login and registration in a seperate app? If yes then you must use SSO instead of creating users via API.
---
### Author:  [@adam\_beers](https://meta.discourse.org/u/adam_beers)
#### Post date: [December 4, 2016, 3:17am UTC](https://meta.discourse.org/t/what-should-password-field-be/53167/4 "2016-12-04T03:17:44Z")
Once the user is created by my external site, how does that user then get added to the discourse database? How does a key get created for that user, so they can post things to the site?
---
### Author:  [@vinothkannans](https://meta.discourse.org/u/vinothkannans)
#### Post date: [December 4, 2016, 6:15am UTC](https://meta.discourse.org/t/what-should-password-field-be/53167/5 "2016-12-04T06:15:19Z")
Just to keep all the discussion in one place, I’m replying to your message here.
> [@On another topic](https://meta.discourse.org/t/53761/1):
>
> I have created an Android App for a private discourse server. I’m having issues with authentication. How does the “signin” work? What would the flow be, using the API? I have a current flow, but not sure if it is correct. Here is what I do:
>
> /session?api\_username=&api\_key= (With login and password as part of POST parameters.)
If you use your master api\_key in your android app then you have serious security issue. Developers can decrypt your app and can get api key easily.
> [@On another topic](https://meta.discourse.org/t/53761/1):
>
> I have been investigating using Google Firebase as the Auth SSO, but I’m not sure how to create the user in the Discourse forum after it was created in the Firebase database.
Firebase will return `IdToken` on successful login. You should send this to your server and validate it using one of the methods in [Verify ID Tokens | Firebase Authentication](https://firebase.google.com/docs/auth/admin/verify-id-tokens). If it successful you can generate user api\_key on server itself and send to android client.
Also you can store the `user api_key` (not master api\_key) on Firebase behind auth rules and retrieve anytime.
---
### Author:  [@adam\_beers](https://meta.discourse.org/u/adam_beers)
#### Post date: [December 4, 2016, 6:21am UTC](https://meta.discourse.org/t/what-should-password-field-be/53167/6 "2016-12-04T06:21:39Z")
If I don’t use Firebase, but use the normal Discourse auth, what is the normal API flow for creating a user and then having that user login?
How long do the user API keys last? Do they expire?
Also, if I allow Google and Facebook logins, how are those users created in the Discourse server using API calls?
The CURL for creating a user indicates that an api\_key and api\_username are required. What are those if a user is trying to create a new account and they don’t have a key or username?
> curl -X POST --data “[name=dave&username=dave&email=dave@example.com](mailto:name=dave&username=dave&email=dave@example.com)&password=P@ssword&active=true” [http://localhost:3000/users?api\_key=test\_d7fd0429940&api\_username=test\_user](http://localhost:3000/users?api_key=test_d7fd0429940&api_username=test_user)
---
### Author:  [@vinothkannans](https://meta.discourse.org/u/vinothkannans)
#### Post date: [December 4, 2016, 6:43am UTC](https://meta.discourse.org/t/what-should-password-field-be/53167/7 "2016-12-04T06:43:08Z")
Like I already told SSO is the best option even if you have Google, Facebook logins in original website.
#### For Android app
Simple solution is buy hosting at [discourse.org](http://discourse.org). Discourse already have open source android which is currently work only their customers.
Else you have to autorize Discourse instance from android like how they did in their official app. Stll you may use SSO in this case.
I think since it is little advanced concept, if you want more help then you have to post a job in #Marketplace. Then myself or someone else will help you to find alternative solution.