I would like to use digital signatures to secure access to a RESTful API, exactly as described here under "Message signing using Digital Signature". Extract:

When signing, the sender uses their private key to write message’s signature, and the receiver uses the sender’s public key to check if it’s really from the sender. A timestamp and nonce are used to generate the signature, to prevent reuse against replay attacks. A service (when acting as a receiver) has a list of public keys for all other services that want to talk to it and provides its public key (when acting as a sender) to other services that it wants to talk to.

This seems like the most appropriate method of securing access to my API because the clients are machines (i.e. non-human) users, and I have a known client base who are the only authorised users of the API.

Conscious that I should not be writing security code myself, and that this is a common use case, I would like to know of any identity providers or similar services which provide this authentication method "out of the box". Having done some research on the internet it seems that the major identity providers such as Okta, Cognito etc. only support username and password credentials and not digital signature/certificates.

I'd be really grateful if security specialists with more experience in this field could point me in the direction of possible suppliers, or tell me if this is a service which is simply not available and will require me to write custom code to implement. Thanks in advance!

  • 1
    The method that you copied in your question is essentially how authentication using client certificates in TLS works. You may want to consider using TLS client certificates to solve your problem, without writing any code.
    – mti2935
    Commented Dec 4, 2020 at 18:28

1 Answer 1


Client ID and secret are indeed quite common (easy to grasp, albeit not that secure). There are products that support alternatives, though.

Keycloak has pretty advanced features for client authentication, and Okta seems to support key-based authentication as well: https://developer.okta.com/docs/reference/api/oidc/#client-authentication-methods

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .