3 ms·
Sure, but that sounds like bad design out of the box. I'm still trying to find a reasonable use case for these "public keys" (quote from the very first line, to
by JohnStrange 10y ago
Sure, but that sounds like bad design out of the box. I'm still trying to find a reasonable use case for these "public keys" (quote from the very first line, too)
One would assume that public keys are always easy to guess, because they are public? Hopefully they are not used for any sort of public authentication protocol...?
- tofflos 10y agoAPI keys are not always (rarely?) intended to be public. Some (most?) solutions are based on always using TLS. In that scenario the API key alone is sufficient to identify and authorize the user, so the user must prevent the API key from becoming known to others. Some (few?) solutions allow for communication without TLS. In that scenario the API key is usually paired with a shared secret used for signing all messages, so the user is under no obligation to prevent the API key from becoming known to others.