Ask HN: How you do secure your APIs?
I'm looking into adding an API to a small project that I am working on and am wondering how y'all secure your APIs.
Do you use API keys? OAuth? Any tools/services that make it easier?
Do you use API keys? OAuth? Any tools/services that make it easier?
10 comments
[ 3.6 ms ] story [ 35.9 ms ] threadIdentityServer4 for .NET
authlib for python/flask
Basically, you can forward portions of a http request (cookie or bearer token) to another service not accessible directly by the user. That serverice responds with a 200 or not, and the request is allowed, or not.
It's real simple, I've hooked something up to the discord API and other methods like this. Usually, one uses a already built identity system with RBAC built in.
Check out ory kratos and ory oathkeeper. Those fit right in.
https://nginx.org/en/docs/http/ngx_http_auth_request_module....
Granted, you should always validate the authorization on the application side too, but this just adds another layer of security.
We also use OAuth access tokens for a few of our API endpoints. We're looking at rolling that out through more of our API endpoints.
We have a few APIs that can be called without any authentication at all. With this situation, the data returned is typically a subset of what would be returned if called with an API key.
And finally, basic auth for one API that integrates with Prometheus.