In my web application, when the user logs in, a pair of JWT(JSON web tokens),access token and refresh token is sent with some fixed time validity. Using access token client is authenticated and using refresh token, a new access token is generated which works fine. I am not storing tokens in the database.
Now, I want to provide an API package to the client where clients can use our APIs with their developer account.
I researched on the web and found out that API keys and secrets serve the purpose of authorization, not authentication.
I don't have any functions in the API for which client needs user consent. They are simple REST API calls which any user with a developer account can call. Therefore I don't need authorization but I need to authenticate the developer who is calling the API as there is a limit on how many calls a developer can make.
How can we generate some API key to uniquely identify the developer?
Can it be jwt access token without expiry?
Can anyone explain what should be the standard mechanism for this scenario?
I don't want the developer to call login API to get the access token every time.