Building A RESTFul API, How To Do Authentication

Question

I am building a RESTFul API and wondering what's the best way to do auth? Users will need to authenticate. I know of three ways:

1.) Pass API key in every RESTFul requests:

http://api.mydomain.com/api-key-here/get-users

This is nice because developers can immediately start using the API by simply copying URL string into the browser. Are there any potential security risks though?

2.) Every request passes the API key in the header of the request.

This seems to be more secure, but developers can't make requests via their browser. CURL is required.

3.) oAuth

I must admit I don't know much about it, but seems very popular. My concern is that its a barrier for developers to start using the API. They first must be familiar with oAuth, and have it setup.

Thoughts? Thanks greatly.

jer · Accepted Answer · 2011-01-21 04:28:50Z

2

If your concern is burdening developers with a high cost to entry, I suggest basic auth, but running your API over https.

I do this with Diligent Street and it works really well. I use an API Key and couple it with a Secret as the username/password combination for basic auth.

answered Jan 21, 2011 at 4:28

jer

20.3k5 gold badges48 silver badges70 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Justin Over a year ago

Yeah it will be SSL, but security is somewhat important. How do you use a secret key to couple to a username/password combination? Do users pass both the API key and the secret in every RESTFul request URL?

jer Over a year ago

Yes. I use the API key as the username, and the API secret as the password. It's a very simple method that's easy to implement, and if it's running over SSL, it's harder for anyone to gain access to the credentials.

Justin Over a year ago

How do you send the username and passwordk though in the URL? Or do users have to set it in the header?

jer Over a year ago

Users can set it directly in the URL should they choose, it is HTTP basic auth after all, but you shouldn't do it that way. Instead set the appropriate header. Base64 encode it, and pass with the Authorization header.

incredimike Over a year ago

Thanks for this answer. You've kept me from over-complicating things. :]

hylander0 · Accepted Answer · 2013-10-30 17:01:03Z

0

I have employed the technique found here: Build a RESTful API. This solution uses an MD5 hash of your API ID, API secret and the UNIX Time stamp and passed in the HTTP header. This authentication method is the same used by Mashery’s Authentication.

This link references and contains a full blown starter kit for creating an API that has Auth, Membership and*API Usage Metering* along with a supporting EF database.

As for testing the service you can use RESTClient to execute HTTP calls with custom headers instead of using Curl.

answered Oct 30, 2013 at 17:01

hylander0

1,10011 silver badges25 bronze badges

Collectives™ on Stack Overflow

Building A RESTFul API, How To Do Authentication

2 Answers 2

5 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

5 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related