API Keys and Basic Authentication

An API request can contain more than an identity claim. Its parameters can also specify an action, an amount, or the resource being accessed. For many ordinary requests, a vendor mainly needs to know who has the API key. For sensitive operations, the vendor may also need assurance that the request was not changed while traveling to the server. Cryptographically signed messages provide this additional assurance: they help verify both the source of the request and whether the request was altered in transit.

A signed request begins with the request message and a shared secret key. The client combines them using a mathematical algorithm to create a signature. The client sends the request and the signature to the vendor. The secret itself is not the item being sent as the signature; instead, both parties use their knowledge of the shared secret to participate in creating or checking the signature. The server independently recomputes the signature from the received request and its copy of the shared secret. If the recomputed result matches the signature sent with the request, the signature supports two conclusions: the request came from someone holding the secret, and the request has not been changed since it was signed.

When a request contains only an API key, the server knows that whoever sent it possesses that key. However, an attacker could intercept the request, change its parameters, and forward it while leaving the API key present. The server would still accept the request because the key is present. A signed request adds an integrity check: changing the message makes the original signature fail verification.

Not every request needs a signature. Simple API key authentication is sufficient in many situations where the main concern is identifying who is making the request. A vendor is more likely to require cryptographic signing when the API modifies sensitive data, performs financial transactions, or provides access to protected resources. In those cases, the vendor wants evidence that the requester is authorized and that the request was not altered in transit.

OAuth is a widely used standard technology for signing requests over the Internet. It belongs in the same request-security discussion because it is a recognized way to support signed Internet requests; the underlying assurance still depends on the credentials and secrets used by the participants being kept confidential.