[samwillis]

Two questions:

How are you connecting to the users energy supplier, I assume most don't have their own apis and so you are having to save the users login credentials? If so you should list the security measures you are taking to ensure that are safely stored. This is much like how developers had to connect to banks before they started supporting standard apis.

Which utility companies can you currently connect to? Again may be worth listing them on the site.

[drewkim]

Great callout. Passwords are encrypted using a 256-bit AES cipher and are never persisted or shown to developers in plaintext. We currently support PG&E and SCE with a ComEd integration landing within the week.

[westurner]

What does it cost a utility to add e.g. read-only OAuth token support to their customer-facing app?

FWIU, it's pretty easy to add OAuth support to any HTTP API endpoint with e.g. Nginx auth_request or by integrating an OAuth library with automated tests into the application at the url routes, if nothing else.

Do you have a "Guide for utilities who want users to have a safe third-party read-only API", a Developer portal, or like a decision tree for which script to read a decision-maker or a front-line lackey who doesn't know anything about APIs?

Does Pelm integrate with Zapier? https://zapier.com/platform

[jzig]

I'm confused, ComEd is an Exelon opco but PG&E is not. Or does ComEd mean something else here?

Edit: Maybe nevermind, I think I read the sentence incorrectly. You are saying you will have ComEd integration soon?

[drewkim]

Correct, we'll have a ComEd integration soon

[woqe]

Can you go into more detail about this? I may be misunderstanding, but I read 'never persisted' as meaning my users must provide credentials for every API call.

[drewkim]

Ah, I meant plaintext passwords are never persisted in a db anywhere. The only time passwords are decrypted are when they are used to programmatically log in, so they're never stored anywhere except in memory.

[samwillis]

Out of interest what’s the architecture you have gone with for key rotation and storage, and where the encrypted passwords are stored. (Understand that as an very early stage startup you probably haven’t optimised all this yet)

I know some other services that have had to go this route have used quite elaborate systems to ensure separation between keys, passwords and user details in the event of a hack.

[drewkim]

We use a secret manager on our cloud platform for key storage, manually rotate keys (for now), and store encrypted passwords on a separate db.

[samwillis]

Perfect. Thanks.