Asked a follow up question (see this link).
Based on my understanding, I have to issue an unique ClientId and Client Secret Key to the API subscribers right after the registration phase (client lives with those keys forever).
Am thinking to issue just a ClientId (Auto-increment Integer value) to the API subscriber with instructions stating that he must send the Client Id along with Client Secret Key with every request. So, that I can use the ClientId to query the database table and perform a validation on Client Secret Key.
- Should I encrypt ClientId (Auto-increment Integer value) and Decrypt every time I receive it and perform validations?
- Currently, the Client Secret Key is generated using SymmetricAlgorithm.