I would like to use digital signatures to secure access to a RESTful API, exactly as described here under "Message signing using Digital Signature". Extract:
When signing, the sender uses their private key to write message’s signature, and the receiver uses the sender’s public key to check if it’s really from the sender. A timestamp and nonce are used to generate the signature, to prevent reuse against replay attacks. A service (when acting as a receiver) has a list of public keys for all other services that want to talk to it and provides its public key (when acting as a sender) to other services that it wants to talk to.
This seems like the most appropriate method of securing access to my API because the clients are machines (i.e. non-human) users, and I have a known client base who are the only authorised users of the API.
Conscious that I should not be writing security code myself, and that this is a common use case, I would like to know of any identity providers or similar services which provide this authentication method "out of the box". Having done some research on the internet it seems that the major identity providers such as Okta, Cognito etc. only support username and password credentials and not digital signature/certificates.
I'd be really grateful if security specialists with more experience in this field could point me in the direction of possible suppliers, or tell me if this is a service which is simply not available and will require me to write custom code to implement. Thanks in advance!
