60

I'm interested in creating API keys for web.api and allowing clients to communicate with API using the API keys rather than authorization web.api provides.

I want multiple clients to be able to communicate with the web.api. instead of creating username and password, can I use an api key, and allow clients to communicate with client.

Is there such built-in functionality?

if one wants to implement it, how would you go around it?

1 Answer 1

73

You are able to achieve by using HMAC Authentication. Basically, there might be a database table called ApiKey (apiKey, secretKey). Each client has each Apikey and secret Key:

  1. ApiKey is like a public key and will be sent over HTTP (similar with username).

  2. Secret Key is not sent over HTTP, use this secret key to do hmac some information and send hashed output to the server. From server side, based on the public key, you can get the relevent secret key and hash information to compare with hash output.

I have posted the detailed answer at: How to secure an ASP.NET Web API

You can change Username by ApiKey and Hashed Password by secret key on my answer to map with your idea.

17
  • So you will require the client to build the Hash on every API request? What is the overhead involved here? Aug 6, 2012 at 15:41
  • I think so, that's the way which HMAC works, please could you elaborate your questions?
    – cuongle
    Aug 6, 2012 at 15:47
  • If you will call ComputeHash(string hashedPassword, string message) on every method the client calls, how much time does that add to each call? How long does ComputeHash take to complete on average? Aug 6, 2012 at 15:49
  • 1
    Thats nothing, less than a millisecond. So almost no overhead at all, very nice. Aug 6, 2012 at 16:01
  • 1
    Getting a key to the user has always been a struggle. You could use a 2 step process: have a hashed + salted password sent (along with the salt) over ssl to the service, and have the service send back the associated key. Future transactions use the (hashed + salted) key instead of the password. You could use the password to reset the token as well this way. Feb 9, 2013 at 5:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.