I am using Google's OAuth2 for authentication for a website which also has a RESTful API component. I would like to support connections from clients which are not within a web browser. Also, I'd like to avoid maintaining a list of usernames and api keys. I'm contemplating this scheme :

  1. User logs in to the website using Google's OAuth2 and a browser.
  2. The website presents the user with an API key by first making an HMAC-SHA1 of :

    • a secret key on the server
    • the username
    • the current time

    and then concatentating that with the username and time, and base64 encoding it all.

  3. This key must be sent by the client with every request : it will be validated by the server, and can be expired by comparing the time to the current time.
  4. Everything is served over SSL.

Does this sound reasonably secure?

Thanks in advance for any thoughts.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.