Videos
[EDIT] I'm concerned about generating my own API keys for authenticating users in my own project, not using an API if another service.
Hello there! Recently I've started reading on REST API and how to implement one, and currently I'm looking at the use of API keys for authentication. I'm confused on how the URL path should be constructed for different users, and whether the API key should be placed in the URL or within the HTTP header.
From my understanding, API keys are like your email/password when logging into a website, but they are usually encrypted in the database and used for verifying if a certain request like GET/POST can be called. From the guides I've read online, these API keys are stored as parameters in the URL, for example: http:/localhost:3000/users/?api_key=some_long_api_key. But with this approach, what's stopping someone from copying the API key who isn't authorized and using it in making requests?
The other option was to embed the API key in the body of the request, but I'm still wondering if this still suffers from the issue of someone who isn't authorized from making their own request body using it.
The other approach I'm thinking about is where before the request is made, the client retrieves the API key for the currently logged in user and then sends a request using that API key, ensuring that it is hidden from the url, but then again what's to stop someone from viewing the body of the request and getting the API key, unless encryption is required while sending it.
The above approach is what I'm planning to do, although I don't know if it the correct way to do it. For instance, my though process about doing this is as follows:
A new user registers with an email and password,
An API key is generated for the user,
When a request is sent, like posting some form data, the API key is retrieved for the current user and encrypted, then placed in the body of the request,
On the server, it first validates the API key and then continues with the request.
Also, for generating an API key, is generating a UUID good enough? Along with that, is it okay to send the user's email in the body of the request to identify which user is making the request? Is it possible that two user's can have the same API key, which would require sending their details to the server to know which valid user is making the request? I've never worked with API's before so I am curious to how this is solved from a security standpoint...
Thanks in advance and have an amazing day!