I was wondering if giving users choice of a method for securing their access to API would be a good idea.
We are creating and deploying applications for our customers, which help them do their work more efficiently. Each of our clients is running a self-contained application and we plan to create an API that will allow them to integrate their third party tools or what have you. It will not be a public API but a private one.
Now, when researching the subject I came into an understanding that using basic auth, even through HTTPS is not a very good idea. Apparently, preferred method would be using HMAC with nonces. I am all for securing the fort, however HMAC solution presents one problem - its more complicated and requires developer to firstly create HMAC and then feed it into a request, basically making whole API not easily discoverable (like you cant just type in
curl https://my.url/api/endpoint/ and see what happens).
It cam to my attention that people at Stripe do use basic auth with token as a user so their curl request looks like this:
curl -u sk_test_mysecretrandomkeywhatever https://my.url/api/endpoint/
This is my book is a big advantage and if its good enough for payment processing company then perhaps it will be good for us too?
Then I got thinking - what if we offer both as a choice? You want to use basic auth only? Fine, you can use only that. One of your clients is a security freak and wants to make sure that your system is secure? Enable HMAC authentication and start playing with HMACs etc. Is that a feasible solution or would you say it is a security travesty?
Please shed some light on the subject or at least point me in a right direction.