Asked a follow up question (see this link).

Based on my understanding, I have to issue an unique ClientId and Client Secret Key to the API subscribers right after the registration phase (client lives with those keys forever).

Am thinking to issue just a ClientId (Auto-increment Integer value) to the API subscriber with instructions stating that he must send the Client Id along with Client Secret Key with every request. So, that I can use the ClientId to query the database table and perform a validation on Client Secret Key.


  1. Should I encrypt ClientId (Auto-increment Integer value) and Decrypt every time I receive it and perform validations?
  2. Currently, the Client Secret Key is generated using SymmetricAlgorithm.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.