3 ms·
I can see the benefit of OAuth if you have an API that multiple customers will use since it allows your customers to manage the security themselves, to create a
by tbirdny 5y ago
I can see the benefit of OAuth if you have an API that multiple customers will use since it allows your customers to manage the security themselves, to create and revoke tokens. I'm wondering, is there any benefit to OAuth if the web service is for your own company, between your own servers, even if the traffic goes over the internet, compared to using a simple token in a header that you generate by hand and the api checks for a match?
- paxys 5y agoBetween your own servers – not really. For that use case OAuth2 will be just as effective as a single shared secret.
- Too 5y agoIt gives you a single place to manage roles and access, RBAC. Saving you the hassle of managing api key generation- and provisioning for N consumers multiplied by M services. Second thing would be that you don’t have to think about api key rotations and revocation everywhere, the only auth is done to the idp (possibly with mfa) and from there everything else is short lived tokens.
- tomjen3 5y agoI really hate the idea of OAuth. I expect that your API can be used with an app-generated password that I can stuff into an Authorization header. I don't like APIs that are not curlabel.