I have a web-site for which I'm building a Drupal module that allows the users of that Drupal site to navigate to my web-site directly from the Drupal site.
I intend to distribute secret API-keys to each of the Drupal site administrators and they need to enter that value in their copy of the Drupal module.
When this Drupal site presents my module to its users, clicking on certain links should take the user to my site along with a set of secret data that my site can use to authenticate this navigation. There will be a FORM presented to the user and a link present so that clicking on the link 'submits' the form via POST and redirects the user as well.
I need to use this secret 'api-key' to generate some sort of time limited / one-time code that will be given to the user's browser. Any smart user copying this generated code shouldnt be able to reuse it to enter my site later on.
Should I be using this API-key as a password to encrypt some data that matches the rest of the POST request? When receiving it, I decrypt it using my copy of their API-key and it if matches the rest of the data, I consider it validated?
Or should I do some sort of one-way hashing - md5?
Should I one-way hash the current time and allow access only for 5-10 minutes?