I've been reading a lot about many API security considerations, the differences in terminology, OAUTH, OpenID, etc. Although I understand their absolute necessity when it comes to securing an API properly, I am confronted with my (perhaps naive) vision of how things could be. I was hoping you could tell me how wrong or right I am and point me in the right direction. That would certainly be appreciated.
So, what exactly was I asked to do? -- The company I work for, called Company X, has lots of data stored internally. We now finally have an external PostgreSQL db in place and a webserver using Amazon EC2. This works really well. Now, I use Slim Framework to create routes, handle GET/POST/PUT/DELETE requests, send out queries using PDO and so on. Now I've come to the point where Company X asks me how their clients will be able to communicate with the API. Now of course I wouldn't hand over grant access to everyone, so I was initially thinking of an API key per client. I've used Instagram and other similar APIs and they seem to work on a similar way. However, I am also reading that "API keys are not enough". I can understand why this method may be too simplistic for a delicate issue of exchanging information, but I don't know if the other options are WAY to complex for the goals I am facing.
So, again to be clear, what I would like to accomplish is the following task: I want users to GET (let's say) notes from our server, I want them to be able to POST notes, updates them and delete them as well.
My question is how I can do this on a secure manner, without having to dive into dozens of protocol documentation. Of course, if that is the way to go then fine, but I am sure that there might be other ways that can prove to be just as safe.
Thanks for reading and especially if you decide to help me or at least tell me how far off I am from thinking with the right frame of mind. :-)