API Key Authentication Best Practices

https://zuplo.com/blog/2022/12/01/api-key-authentication/

by nathantotten • 4 years ago

38 6 4 years ago

molmorg2• 4 years ago

Author of the article here - look forward to any discussion here. Curious how many folks have already implemented something like this themselves... did you make different decisions?

sghosh2• 4 years ago

The checksum validation was something I hadn't come across before. Interesting way to minimize the load on the API key store.

molmorg2• 4 years ago

Yeah, some folks might consider going further and use hashes that salted or one-way encrypted via key so that nobody else can recreate the checksum. Some performance tradeoffs but can prevent some other vectors like cache-filling etc.

devCreek• 4 years ago

Regarding retrievable vs. irretrievable, I think is a matter of who do you delegate the ownership of the security. Using Irretrievable, you are transferring that to your users, which in a lot of scenarios just store them in plain text in non secure places.

I think having the chance to retrieve the api keys gives a much better Developer Experience to your consumers.

DataOverload• 4 years ago

Never thought of it that way, and honestly this is so correct. Some of my PATs are stored in Apple Notes because I need them every so often. I guess I could use something like 1Password to store them securely but it's just another transfer of ownership and trust.

ChaosMuppet• 4 years ago

With regards to secret scanning, a shout-out to the "secret-token" URI scheme https://datatracker.ietf.org/doc/html/rfc8959

Also, in addition to showing the creation date of the API key, I find it super friendly if it is possible to name the API key (and/or add a note to it).

API Key Authentication Best Practices

Related Stories