I am using Google's OAuth2 for authentication for a website which also has a RESTful API component. I would like to support connections from clients which are not within a web browser. Also, I'd like to avoid maintaining a list of usernames and api keys. I'm contemplating this scheme :
- User logs in to the website using Google's OAuth2 and a browser.
The website presents the user with an API key by first making an HMAC-SHA1 of :
- a secret key on the server
- the username
- the current time
and then concatentating that with the username and time, and base64 encoding it all.
- This key must be sent by the client with every request : it will be validated by the server, and can be expired by comparing the time to the current time.
- Everything is served over SSL.
Does this sound reasonably secure?
Thanks in advance for any thoughts.