Using Simple JWT for Public Facing API Auth

Question

I'm looking at security methods for APIs. Using JWT access tokens after client login with user/password will work well for internal web apps using our own APIs. However, I'm looking at how we should secure our external APIs that other systems/clients may use to consume data.

I typically see API services providing a client_id and client_secret. This, however, ends up being used in OAuth2 which I'd rather not have to implement as I'm not confident of a successful, secure implementation of such a big spec and nor do I want to be dependent on auth0.

I think that if used simple JWT for external APIs consumed by applications then I'd have to have a different identity type than user/password. Such as an ID and secure key. What would be best?

Answer 1

Yes, a simple token is enough to consumed securely a public API.

Structure of this token :

• a unique part or must be unique itself (this will be the id)
• a random part

Only the person which has the token can access the API. On each request to the API, you send the token with it. Your API validate the token and return the data if it's valid.

But, the tricky question is how do you get this token?

You will need an authentication page somewhere. After the user is authenticated you can let him create/download an API token. He can then gives this token to anyone or any applications he want and they will be able to access his data.

OAuth2 mostly automate the process of obtaining this token so the user doesn't have to do manual step like copy&paste to share the token.

Note

A game that I played in the past used this scheme for it's public API : Guild Wars 2. When accessing their account on the website, a user could create and copy their token, then give it to other applications that would analyze their account information.