I have worked on many API integrations scenarios, and I used 2 approaches to authenticate the API calls, as follow:-
- Using API Keys
For example inside hubspot integration i use this web call to get all the accounts using API Key:-
- Using OAuth.
For example inside SharePoint >> I create an app which generate a ClientID & ClientSecret, then inside my project
web.config i pass/define the clientID & CleintSecret
<appSettings file="custom.config"> <add key="ClientId" value="e****7" /> <add key="ClientSecret" value="**=" /> </appSettings>
now in both cases we have confidential info been passed/stored, either APIKey or ClientID and ClientSecret. so can i say that from a security point of view I can not say that oAuth is more secure compared to using APIKeys? as if someone (let assume a hacker) get the APIKey then he can integrate with the our application + if a user got the ClientID and ClientSecret then he can integrate with the application as well..