Web API without security risk

[Sam1415 (Peter pan)]

When you create a bearer token for the api, you can control for every token which rights you want to grant for this token. Did you already check this?

Web API Authentication

This is part of the Nuki Web API documentation. Successful API calls require appropriate authorization: The bearer token (also see https://swagger.io/docs/specification/authentication/bearer-authentication/) needs to be present in each request to the API. There are several ways on how to obtain a valid bearer token, which we will describe in the upcoming section. Curl call from the Swagger example: curl -X GET --header 'Accept: application/json' --header 'Authorization: Bearer c2c0981ffcab78ee…