How to protect an open API endpoint?

userrAya1 0
Viewed 21

I have an API that doesn't have an authentication (intentionally). How can I secure it so only my application can make requests and API can identify those API requests coming from that server only?

security authentication rest api
1 Answers

Well, you need authentication

In order to verify who is calling your API you need to authenticate them. This doesn't mean that you have to authenticate users. Applications can also authenticate and present their identity to other applications. This is what you need here. You can achieve such app-to-app authentication in a few different ways:

  1. Basic authentication. You can save an ID and a secret in your application and use them to send the Authentication header.
  2. Use OAuth's client credentials flow. This is an OAuth flow that is made specifically for apps to identify themselves to other apps.
  3. Use mutual TLS. You can tell your API what certificate will your application use and accept only connections with that certificate.
  4. Identify with JWT Assertions. In this approach, your application signs a JWT with its ID and the API is able to verify the signature of the JWT.
Michal Trojanowski0
Related