Why HMAC/Signed API requests are not prevalent compared to API keys or JWT based requests

Question

While all/majority of AWS APIs requests are signed with HMAC, it is not as prevalent for other APIs in general.

Most likely, the reason is because of the gotchas involved when client has to make the signed API work as they may miss a few headers etc or new headers got added by proxies and so signatures don't match etc.

HMAC signed requests have clear benefits like there will be no secret is in transit and there has to be protection of the secret at rest on both Client and Server, though.

What could be a scenario where product teams should be enforced with signed API requests and not go with API key authentication , otherwise could be a high risk.

Answer 1

Currently industry is pushing towards forward secrecy. The big advantage of HMAC is that if both parties involved agree to exchange them offline then at no point in time will this HMAC be transmitted over the network, this has huge impact on requirements related to secret rotiation amongs others.

One clear advantage you get right away is that you can then generate this HMAC in the HSM (hardware security module) and wrap it for exchange (with key generated by receiving party). Key exchange done this way is generally considered as secure as the underlying system protecting the key (which if done correctly is very strong).

Generally HMACS should be used for high value data. You can take API of financial applications as an example. Both parties must limit their trust as much as possible to avoid possible exchange of sensitive data with possible adversaries.

To avoid any misunderstandings, HMAC does not provide general security on its own, it only takes care of the message authentication which is only a little part of a bigger picture.