3

Our product allows 3rd party components to talk to it via web services using an API key (a 'bearer token'). The developer of the component generates the API key in our app and then stores it with their component.

We were recently asked by a few customers about switching to OAuth2 instead of simple API keys for improved security.

We need to use the Client Credential Grant Type for this as there is no 'user' involved in the flow. However, this requires storing the client id and secret along with the component.

How is this more secure than just storing an API Key with the component? Don't they have the same attack surface (anyone with access to that component can spoof it)?

1

They may not be trying to improve the security of your end of the connection. They might be trying to improve their own security, and the security of their customers, by getting rid of a home-grown or unproven authentication mechanisms.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.