I am looking to build a number of simple REST web services where:
- they are only accessible by HTTPS (no downgrade to HTTP)
- clients will only be deployed to secure, trusted locations
- clients will each have a unique API key
- each service will hold a list of permitted client keys
When accessing a web service, a client will provide it's unique client key in each request body for authentication to that service.
Question: Is this simple approach sufficient to restrict access to the services to only known clients?