API Keys
Erlend Hamnaberg <[email protected]>
| Newsgroups | gmane.comp.web.services.rest |
|---|---|
| Message-ID | <CAKj3E3YtvrytWRGMBDY8cKbYCCy=xnaUzJ2mWqfw-LapZJiZeA@mail.gmail.com> |
Hi. Is there anyone with experiences with implementing API Keys in their apis? Putting the APIKey in the URI is obviously a bad idea as that leaks to every cache and intermediary. Including Apache logs. So it must be a new header field. The problem with APIKeys as such is that they are spoofable, unless they are crypographically protected somehow, so my question is: What do you do in your api? -- Erlend ps: I am thinking about writing up an internet draft for a new Api-Key header field.