4 ms·
I'd like to request a "recipe" for handling authentication to my API. I want to know: what use is an API key? Should I be authenticating client apps separately
by delinka 11y ago
I'd like to request a "recipe" for handling authentication to my API. I want to know: what use is an API key? Should I be authenticating client apps separately from users? (That's users of the application into which the API reaches.) What are the tradeoffs of sending login credentials with every request versus using a token?
Maybe this particular cookbook isn't the place for it, but I'd really like to see something cover this. It's a problem that stumps me.
- awinder 11y agoThe purpose of API keys & tokens are to bring user authentication details out of every request. This is helpful in many scenarios: 1. API keys and tokens can be more easily replaced / canceled than entire accounts in the case of being breached 2. API keys & tokens can commonly have additional access restrictions applied, while it's hard(er) to do that for a whole account 3. Likewise, it's easy to think of many-tokens-to-one-account systems, where you encourage users to use different keys for different integrations, which helps lower the surface area of the damage one leaked detail can do 4. Many authorization protocols, like OAuth 2, rely on temporary tokens, which are even more helpful in that they guide application integrations towards not hardcoding sensitive details Just a few reasons & justifications off the top of my head.