0

I have an API that responds to requests with a JSON that contains app updates and advertisements.

Requests are sent by my SDK that is implemented inside my game.

I need authentication because JSON responses contain some advertise provider keys that I don't want to be accessed by others(those who may send requests to API to access those tokens), so no one else than the game developer should be able to get responses from API.

SDK manages advertisements itself and game players have nothing to do with those data.

What's the best approach for implementing authentication for these SDK to API calls?

My idea is to use individual predefined tokens for each game SDK; I'm Not sure this is the best choice or not.
token 123 : developer1 with 100 users (one game)
token 456 : developer2 with 1000 users(one game)

Something like this:

SDK request to test.com/myapi/gameName :

post: {
   "token" : "123token"
}

and for game 2, we use another token:

post : {
   "token" : "456token"
}

(123token and 456token are supposed to be predefined tokens in API for each game endpoint)

then API responds with a JSON content:

{
"gameTokens" : { ... } ,
...
}

Flow:
sdk flow

Improve this question
5
  • 1
    This is missing quite a few details. Why do you want to authenticate? What control do you want to have? What do you want to limit your users to? What does "the only user of API is the programmer itself." mean?
    – schroeder ♦
    Dec 24, 2021 at 9:32
  • @schroeder thanks,i edited my question,my mean of "the only user of API is the programmer itself." is that game players are not required to do any login/authentication and the only request sender is the game programmer that uses SDK
    – Winner1
    Dec 24, 2021 at 9:45
  • 1
    please clarify if the following example is a correct interpretation, eg. programmer A sdk token 123 users 4,000 and programmer B sdk token 456 users 120, or in total: (4,000 api-callers using token 123 and 120 api-callers using token 456)?
    – brynk
    Dec 31, 2021 at 3:09
  • @brynk yes exactly, it has one token for one game with multiple users, thanks for that example, I edited my question also
    – Winner1
    Jan 1, 2022 at 18:14
  • 1
    each token would be distributed with the end-user app - this means that i could decompile and extract the token, and then use it to make api calls - some options are to put it back onto the programmers to proxy the api requests, or authenticate the users directly, or authenticate the users' requests "somehow" .. for this you might consider OAuth 2.1 (draft-ietf-oauth-v2-1-04) where users negotiate with your api to receive a grant, which must be "blessed" by the game server with a token, that is then used in api calls
    – brynk
    Jan 1, 2022 at 22:52

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .