How are you generating & issuing API keys to your customers?
Hey Hackers,
I spend a lot of my time building API based products. One of the biggest challenges associated with them is the generation, issuing, & verification of API keys.
Can you recommend any tools that can help streamline this process or make it self-server for my end users?
I'm building Lightfront to solve this exact problem! Currently in closed beta.
That is great! Any way I could check out the closed beta?
Hi @matthensleyio,
Did you take a look at Auth0?
https://auth0.com/docs/quickstart/backend
Don't know if an API management platform like Kong, Tyk, or WSO2.
Kong has the admin API to add keys to routes https://docs.konghq.com/1.1.x/admin-api/
I generated my own API keys for my system. That is not that hard to do and you know what to expect in terms of security/safety.
I've used some APIs on rapidapi.com in the recent past. They handle the security and payment for provider APIs. Check them out.
Thanks @voidmonk, I have heard of Rapid API in the past, but didn't look close enough apparently. Will give them a second look!
Check out the API keys support for Cloud Endpoints: https://cloud.google.com/endpoints/docs/openapi/restricting-api-access-with-api-keys
Which challenges really you face with? Could you tell us more details?
and, Do you generate API Keys yourself?
Hey @nasermirzaei89,
Yes, today I am generating & managing API keys myself. The biggest thing I am noticing is just the coverage of different scenarios that need covered in order to help myself & users sleep better at night.
There is a lot that can go wrong in those steps. As I was finishing up the implementation for my current project it occurred to me it would be nice if there was an "off the shelf" solution that handled the heavy lifting.
Abou permissions I think you already have something to manage it by yourself. So, provide a UI that users can select some permissions and create an API Key.
You can set an alert for expiration when they create API Key or Allowing them to extend the expiration time of Keys.
What you mean about storing securely?
if your keys are not self-described like JWT, you can allow users to remove them or set the expiration time to now. and if they are self-describing, users should be able to mark them as a blacklist item until the key expiration time.
Which part is hard or ambiguous?
That is a good point about already having to manage things yourself for permissions.
It isn't so much that it is hard or ambiguous, I think it is just the repetitiveness of building it. It seems like something an API & lightweight client library could manage pretty easily.
¯\(ツ)/¯
It depends on what you use for building your products.
By the way, I don't know any tools to do it by
This comment was deleted 6 years ago