4

We are in a process to expose some data (not sensitive) via REST APIs. Our API consumer requested the same using only API Key authentication. No Mutual Authentication TLS, no OAuth but plain simple API Key based authentication.

I would like to get some inputs to understand what are the different precautions we should consider to host such APIs as provider.

Consumer have their interface exposed as browser based client (web page) & they would like to call the APIs directly from client side browser app (not from web server). I heard it is existing pattern & if data is not sensitive it can be supported. But I like to make sure that all possible precautions from security perspective has been taken.

Improve this question
3
  • 5
    an API is just a funny-looking webpage, same rules and considerations apply.
    – dandavis
    Mar 18, 2018 at 12:41
  • 2
    If the data is not sensitive, why are you authenticating the client at all? Just put it up without authentication, return Access-Control-Allow-Origin: * in response to any CORS request (so web browsers can request the information from arbitrary pages without running into same-origin policy), and call it a day. That is, of course, assuming that the data is truly not sensitive (i.e., completely public, not specific to any user or in any way private).
    – CBHacking
    Mar 13, 2019 at 21:42
  • I'm not totally clear what the question is. First, I would recommend looking over the OWASP API Security top 10. Secondly, CORS would help increase the security of key based auth.
    – nickdew
    Apr 6, 2020 at 23:33

2 Answers 2

Reset to default
1

Handing out some random string as API key is possible, but this does not allow you to enforce any fine-grained access policies. If you want to prepare for more fine-grained access policies, then you might hand out a signed JSON Web Token (JWT).

From your customer's perspective, a JWT can be simply added to an HTTP header.

Improve this answer
0

In the case where you host a multi-tenant SaaS app and the customers truly own their data and access to it, API keys make a lot of sense. Octopus Deploy is a great example of such an app. Here are some best practices.

  1. Allow each customer to create one or more API keys within their tenant.
  2. Force each customer to rotate their API keys by enforcing an expiration date.
  3. Tie each API key to a real user for auditing/logging.
  4. Each API key, by being tied to a user, should also be subject to role-based access (RBAC) controls so that you can create granular API keys for different purposes (reporting, administration, e.g.) while still maintaining least privilege.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .