I'm making an API for my own software. The API currently used for registering users, viewing users information and updating users information.
In the future it will be used for billing, support etc ...
The API is currently visible online, it's only security currently is that to view or update a users information you need to know their unique ID which is a random number between 1 Billion and 2 Billion.
The only client for my API will be my own front-end that I'm yet to write.
I read about HMAC and OAuth and both solutions seemed extremely complicated.
Here are my current ideas to keep my API secure:
1. Use HTTPS for all requests. 2. Don't tell anyone the address of the API (I know I probably shouldn't rely on this) 3. Send an access key and a secret key to the API and the API sends back a token that is valid for 1 hour. (Maybe less)
Would the access key, secret key and HTTPS be sufficient to secure my API?