I created a large backend+frontend project for a client. They recently started a different project, and contracted an other company to develop and host it. Since they need some of the data from my project, they asked me to develop an api, so they can access the required data.
I created a rest api, where the client is authenticated with an api key. This api key is sent in each api request in a http header, named
X-MY-AUTH-CODE. Since the api is only available over https, as far as I know an attacker is not able to eavesdrop the communication, and access the api key.
Some folks recommended me to use
OAuth 2 for this task, but I don't understand, what would I benefit from it:
- The users don't have to consent to anything
- It is purely a server to server communication
- The OpenApi tokens are also sent in an
Authorization: Bearerhttp header, which as I see is just as secure as sending api keys
How could a server to server rest api communication be more secure or straightforward, by using OAuth 2?