This question is an exact duplicate of:
I have a use case where external 3rd party remote servers (which I do not own or control) are sending data using a POST request to my central server over the internet. Each of these remote servers is given a non-expiring token (stored on the file-system or hard-coded in their application) which they send along with the POST request. I have an internal mapping in my database between these tokens and remote server IDs.
These external servers make frequent API requests to my server.
All communication between servers happens on HTTPS.
- Is this in-line with the current security measures for securing API requests? I have seen OAuth2 but I feel that it is an over-kill for my use case.
- Since I do not own these external servers, what measures can I put in place to ensure that communication is happening from the servers that were originally authorized in-case the tokens get stolen.
Am I missing any other considerations?