10 ms·

My API currently does auth inline in the GET request URL in order to make this possible. An example request would be: GET https://v6.exchangerate-api.com/v6/YOU

by 256DEV 5y ago

My API currently does auth inline in the GET request URL in order to make this possible. An example request would be: GET https://v6.exchangerate-api.com/v6/YOUR-API-KEY/latest/USD https://v6.exchangerate-api.com/v6/YOUR-API-KEY/latest/USD I've had a fair number of users send me feedback saying this isn't the best practice, I should use tokens in HTTP auth headers or use various other auth schemes. But from my perspective, for an API that is offering really very simple functionality, using HTTPS & not handling user data etc. then this is quite OK - especially when you consider the benefits of how simple it is to get up and running. I have quite a few university course conveners include my free API in their entry level CS classes because it's super fast & rewarding for students to go from finding my API to then having a JSON object in their code, no tokens required!

dmlittle 5y ago
The problem with having your API key in the URL is that they'll likely be logged all over the place when they're meant to be secret. You probably have the keys being leaked in logs, error reports, metrics, etc.
- KeepFlying 5y ago
  True and if this API handled user data or anything substantially private that would be a HUGE deal and super dangerous. But it seems like in this case it's mostly a rate limiting and identification exercise and not a secure protection of user data so the impact of exposure is substantially lower. So it does seem reasonable here. Though I hope that OP has documented all over the place "do as I say not as I do" so people don't copy this pattern.
  - 256DEV 5y ago
    dmlittle's concern is a valid one and for most other types of API I would definitely agree it's not the right approach. I still think it's reasonable for my use case but perhaps I should add another auth scheme as an optional alternative for the user who is concerned about their key potentially being caught in logs. Your point about the documentation is also a good one - I should probably add a specific page just about the authentication approach. Added to the to-do list! Thanks.
    - dmlittle 5y ago
      FWIW you can add HTTP Basic Auth information in URL links and all major browsers and other HTTP clients (for the most part) should interpret it correctly. https://:[API_KEY]@v6.exchangerate-api.com/v6/latest/USD https://:[API_KEY]@v6.exchangerate-api.com/v6/latest/USD If you only have an API key and not a token (username) and secret (password) I recommend passing the API key as a password as some logging solutions do log the basic auth username in the data recorded.

by 256DEV 5y ago

dmlittle 5y ago

The problem with having your API key in the URL is that they'll likely be logged all over the place when they're meant to be secret. You probably have the keys being leaked in logs, error reports, metrics, etc.

KeepFlying 5y ago
True and if this API handled user data or anything substantially private that would be a HUGE deal and super dangerous. But it seems like in this case it's mostly a rate limiting and identification exercise and not a secure protection of user data so the impact of exposure is substantially lower. So it does seem reasonable here. Though I hope that OP has documented all over the place "do as I say not as I do" so people don't copy this pattern.
- 256DEV 5y ago
  dmlittle's concern is a valid one and for most other types of API I would definitely agree it's not the right approach. I still think it's reasonable for my use case but perhaps I should add another auth scheme as an optional alternative for the user who is concerned about their key potentially being caught in logs. Your point about the documentation is also a good one - I should probably add a specific page just about the authentication approach. Added to the to-do list! Thanks.
  - dmlittle 5y ago
    FWIW you can add HTTP Basic Auth information in URL links and all major browsers and other HTTP clients (for the most part) should interpret it correctly. https://:[API_KEY]@v6.exchangerate-api.com/v6/latest/USD https://:[API_KEY]@v6.exchangerate-api.com/v6/latest/USD If you only have an API key and not a token (username) and secret (password) I recommend passing the API key as a password as some logging solutions do log the basic auth username in the data recorded.