Our product allows 3rd party components to talk to it via web services using an API key (a 'bearer token'). The developer of the component generates the API key in our app and then stores it with their component.

We were recently asked by a few customers about switching to OAuth2 instead of simple API keys for improved security.

We need to use the Client Credential Grant Type for this as there is no 'user' involved in the flow. However, this requires storing the client id and secret along with the component.

How is this more secure than just storing an API Key with the component? Don't they have the same attack surface (anyone with access to that component can spoof it)?

  • Have your customer shared any specific reason for migrating to OAuth?
    – jhash
    Commented Jan 20, 2018 at 1:03
  • 1
    This may be of use > stackoverflow.com/questions/34784644/…
    – jrtapsell
    Commented Jan 20, 2018 at 10:43
  • @jhash only that “it’s more secure”. Which is what I’m doubtful of
    – statictype
    Commented Jan 21, 2018 at 9:35

1 Answer 1


They may not be trying to improve the security of your end of the connection. They might be trying to improve their own security, and the security of their customers, by getting rid of a home-grown or unproven authentication mechanisms.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .