HMAC for auth to avoid having the key exposed at every request. For the rest: http://www.javabeat.net/rest-api-best-practices/ http://www.javabeat.net/rest-api

HMAC for auth to avoid having the key exposed at every request. For the rest: http://www.javabeat.net/rest-api-best-practices/ http://www.javabeat.net/rest-api-best-practices/ And documentation: https://github.com/Rebilly/ReDoc/blob/master/README.md https://github.com/Rebilly/ReDoc/blob/master/README.md There many more comprehensive resources about sane API design (use HATEOAS, pagination, etc.) but you don't have to implement everything from v1 ps. SSL goes without saying even if it's a public API