I need to perform sensitive REST API calls between 2 server applications that I am writing. To do this I need to be able authenticate the server that is performing the sensitive API calls.
The current architecture + what I need to add in orange:
*All servers are exposed to the internet.
What I thought to do is:
- Limit sensitive API calls by IP
- All sensitive API calls will need a secret key (do I need to use HMAC here?) that will be validated on the API server
What do you think? Is there a better way to do this?