This question is an exact duplicate of:


I have a use case where external 3rd party remote servers (which I do not own or control) are sending data using a POST request to my central server over the internet. Each of these remote servers is given a non-expiring token (stored on the file-system or hard-coded in their application) which they send along with the POST request. I have an internal mapping in my database between these tokens and remote server IDs.

These external servers make frequent API requests to my server.

All communication between servers happens on HTTPS.


  1. Is this in-line with the current security measures for securing API requests? I have seen OAuth2 but I feel that it is an over-kill for my use case.
  2. Since I do not own these external servers, what measures can I put in place to ensure that communication is happening from the servers that were originally authorized in-case the tokens get stolen.

Am I missing any other considerations?

marked as duplicate by Steffen Ullrich tls Jul 7 at 17:09

This question was marked as an exact duplicate of an existing question.

  • This has nothing to do with server to server security. It is about misuse of the authentication token and it does not matter if this token is used for server to server or client to server communication. Thus marked as duplicate of a question which deals with the topic of access token compromise and misuse. – Steffen Ullrich Jul 7 at 17:10