I'm working on the authentication strategy for my app (again). My current strategy is a clone of the AWS strategy of issuing public and private keys and using them to sign requests sent to my API.

My understanding is that this is a reasonably secure way to authenticate API consumers. However, AWS is phasing out this practice, and I don't really know why.

Is there something I don't know about Private/Public key authentication that poses a security risk to my service or its users?

Is it safe to continue this practice, or should I bite the bullet and move to OAUTH or some other strategy?

The context for the sake of this question is that this strategy is used to authenticate consumers of my JSON-RPC API. Client-side, the private key is used to hash various data contained within the JSON object; server-side the same key is retrieved to compare a hash of the data received with the signature.

Thanks for any help.

Browse other questions tagged or ask your own question.