4 ms·

Ask HN: What do you use for API Key Management?

7 points by dsinghvi 4y ago

Many developer portals allow you to generate API Keys. Is there a SaaS service that is powering these or is all of that logic being built in-house?

roland35 4y ago
If you're using AWS parameter store is pretty good! You can set permissions, have different keys for different environments, and lock them with keys. If you need more advanced functionality there are other options too.
- dsinghvi 4y ago
  Got it! Based on your comment / some googling it sounds like the common use case is for managing internal secrets. Do you think it's a good fit if you want to use it for managing API Keys for your public API (you want your customers to generate a key and use it to call your api)? The 10k parameter limit per AWS account might conflict with that usecase.
stop50 4y ago
Its part of the authorization. The only thing i can think of is the use of JWT for auth. you log into one and get an jwt and the application checks it.
- dsinghvi 4y ago
  I'm not so much talking about the type of token issued (JWT/Opaque), but more about the service that manages issuing and revoking keys. (i.e. something similar to what Stripe has on their developer portal https://stripe.com/docs/keys https://stripe.com/docs/keys). Was hoping Auth0 had a solution for this but Auth0 but doesn't look like they do: https://community.auth0.com/t/how-to-implement-api-keys-using-auth0/6296/10 https://community.auth0.com/t/how-to-implement-api-keys-usin..., https://community.auth0.com/t/how-can-i-generate-api-keys-for-users-stored-in-auth0-with-auth0/44854/6 https://community.auth0.com/t/how-can-i-generate-api-keys-fo...
  - stop50 4y ago
    in most cases i saw in build into the application.
ezekg 4y ago
API key authentication is not very hard, and is typically pretty application-specific. What is stopping you from doing it in-house?
- dsinghvi 4y ago
  It seems like in-house is the way to go since there are no other alternatives. Things we would have to build: - Generating API Keys (with expiry) - Storing API Keys securely - Revoking API Keys - Adding metadata to API Keys It seems like there could be a generic API to power all of that, while still enabling applications to be opinionated about whether the incoming request is authenticated and has the right permissions.
jazzex 4y ago
Typically an API gateway is behind a lot of these. Lookup KrakenD, Gloo Mesh as examples.
- dsinghvi 4y ago
  Got it -- looks like AWS API Gateway also does this out of the box.
bosky101 4y ago
Kong works well, you can choose from various options like just header api key or a key pair or hmac signature based auth from your clients.
Scottsa 4y ago
[dead]
Anna2332 4y ago
https://disq.us/url?url=https%3A%2F%2Fdigitalce.com%2Fblog%2Ftop-marketing-tools-for-your-business%2F%3AfRrBrkjUuMQGd1yiqCxmyZ5QxM8&cuid=1130353 https://disq.us/url?url=https%3A%2F%2Fdigitalce.com%2Fblog%2...

7 points by dsinghvi 4y ago

Many developer portals allow you to generate API Keys. Is there a SaaS service that is powering these or is all of that logic being built in-house?

roland35 4y ago

If you're using AWS parameter store is pretty good! You can set permissions, have different keys for different environments, and lock them with keys. If you need more advanced functionality there are other options too.

dsinghvi 4y ago
Got it! Based on your comment / some googling it sounds like the common use case is for managing internal secrets. Do you think it's a good fit if you want to use it for managing API Keys for your public API (you want your customers to generate a key and use it to call your api)? The 10k parameter limit per AWS account might conflict with that usecase.

stop50 4y ago

Its part of the authorization. The only thing i can think of is the use of JWT for auth. you log into one and get an jwt and the application checks it.

dsinghvi 4y ago
I'm not so much talking about the type of token issued (JWT/Opaque), but more about the service that manages issuing and revoking keys. (i.e. something similar to what Stripe has on their developer portal https://stripe.com/docs/keys https://stripe.com/docs/keys). Was hoping Auth0 had a solution for this but Auth0 but doesn't look like they do: https://community.auth0.com/t/how-to-implement-api-keys-using-auth0/6296/10 https://community.auth0.com/t/how-to-implement-api-keys-usin..., https://community.auth0.com/t/how-can-i-generate-api-keys-for-users-stored-in-auth0-with-auth0/44854/6 https://community.auth0.com/t/how-can-i-generate-api-keys-fo...
- stop50 4y ago
  in most cases i saw in build into the application.

ezekg 4y ago

API key authentication is not very hard, and is typically pretty application-specific. What is stopping you from doing it in-house?

dsinghvi 4y ago
It seems like in-house is the way to go since there are no other alternatives. Things we would have to build: - Generating API Keys (with expiry) - Storing API Keys securely - Revoking API Keys - Adding metadata to API Keys It seems like there could be a generic API to power all of that, while still enabling applications to be opinionated about whether the incoming request is authenticated and has the right permissions.

jazzex 4y ago

Typically an API gateway is behind a lot of these. Lookup KrakenD, Gloo Mesh as examples.

dsinghvi 4y ago
Got it -- looks like AWS API Gateway also does this out of the box.

bosky101 4y ago

Kong works well, you can choose from various options like just header api key or a key pair or hmac signature based auth from your clients.

Scottsa 4y ago

[dead]

Anna2332 4y ago

https://disq.us/url?url=https%3A%2F%2Fdigitalce.com%2Fblog%2Ftop-marketing-tools-for-your-business%2F%3AfRrBrkjUuMQGd1yiqCxmyZ5QxM8&cuid=1130353 https://disq.us/url?url=https%3A%2F%2Fdigitalce.com%2Fblog%2...