I own a REST API at server side and a distinct web application that would call those APIs.

I want to secure my APIs calls.

After some reading, I want to implement the OAuth 1.0a mechanism at server side. Indeed, dealing with temporary tokens, nonces etc.. is by far more secure than a traditional HTTP basic solution that depend strongly on the SSL encryption.

However, in most of examples I found on the web, OAuth seems to be by essence a means to access some data from a resource owner (like Facebook, Twitter etc...) without the need for the user to transmit its corresponding credentials to my own app.

My question is: Does it make sense to implement OAuth if my actors are just my own web application and my own set of API's at server side, (meaning no external data provided by a 3rd party are involved)? Indeed, I really want to benefit of its algorithm.

1 Answer 1


While it isn't necessary to have the complexity of OAuth when authenticating against your own system (because you can share your actual user account data) if you want to provide that level of isolation to the user server, then using OAuth does still afford you advantages. At that point you would simply be implementing a stand alone OAuth provider which your various services could use as a single sign on across your system.

You could also then allow users to use their profile as a single sign on for other services if you so desired by making the OAuth account usable by other sites.

  • Yes, OAuth might be a heavy solution for my case, but I didn't find a standard way other than OAuth1.0a using a mechanism dealing with API keys rather than standard passwords through HTTPS. Even Amazon S3, that provides a great and interesting mechanism (through HMAC-SHA1 algorithm) is not a standard solution for most of developers. As I'm not an expert in security, I want to trust a fully known and tested mechanism, like Oauth so.
    – Mik378
    Feb 14, 2014 at 14:38
  • The other nice thing about OAuth is you can use an existing OAuth provider potentially. There are actually pre-written OAuth account servers you could use so that you don't have to write your own. Feb 14, 2014 at 14:41
  • Yes, I found some companies like StormPath that provides some security features for any app while paying :) I will start to try to implement my own provider. I'm currently searching for a library that could help based on Java or Scala.
    – Mik378
    Feb 14, 2014 at 14:43
  • You may also want to look in to OpenID. It's a bit limited, but it could work as a base starting point for you. I use that for my personal OAuth server. Feb 14, 2014 at 14:45
  • Yes, why not, I have to study the case deeper. And you use an already-written library to build your solution?
    – Mik378
    Feb 14, 2014 at 14:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .