We are in a process to expose some data (not sensitive) via REST APIs. Our API consumer requested the same using only API Key authentication. No Mutual Authentication TLS, no OAuth but plain simple API Key based authentication.

I would like to get some inputs to understand what are the different precautions we should consider to host such APIs as provider.

Consumer have their interface exposed as browser based client (web page) & they would like to call the APIs directly from client side browser app (not from web server). I heard it is existing pattern & if data is not sensitive it can be supported. But I like to make sure that all possible precautions from security perspective has been taken.

  • 3
    an API is just a funny-looking webpage, same rules and considerations apply. – dandavis Mar 18 '18 at 12:41
  • 2
    If the data is not sensitive, why are you authenticating the client at all? Just put it up without authentication, return Access-Control-Allow-Origin: * in response to any CORS request (so web browsers can request the information from arbitrary pages without running into same-origin policy), and call it a day. That is, of course, assuming that the data is truly not sensitive (i.e., completely public, not specific to any user or in any way private). – CBHacking Mar 13 '19 at 21:42
  • I'm not totally clear what the question is. First, I would recommend looking over the OWASP API Security top 10. Secondly, CORS would help increase the security of key based auth. – nickdew Apr 6 at 23:33

Handing out some random string as API key is possible, but this does not allow you to enforce any fine-grained access policies. If you want to prepare for more fine-grained access policies, then you might hand out a signed JSON Web Token (JWT).

From your customer's perspective, a JWT can be simply added to an HTTP header.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.