News for hackers. Stuff that matters.
Re:Ask HN: What do you use for API Key Management? by Anna2332 on Friday September 30, 2022 @07:28AM (#33033498)
https://disq.us/url?url=https%3A%2F%2Fdigitalce.com%2Fblog%2...
[ Parent | on HN ]
Re:Ask HN: What do you use for API Key Management? by Scottsa on Friday September 30, 2022 @07:18AM (#33033442)
Any course of action on this, I'm having a relative issue. I tried to change things and this is what happened. https://www.aimproviderportal.net/
[ Parent | on HN ]
Re:Ask HN: What do you use for API Key Management? by roland35 on Thursday September 29, 2022 @07:28PM (#33028764)
If you're using AWS parameter store is pretty good! You can set permissions, have different keys for different environments, and lock them with keys. If you need more advanced functionality there are other options too.
[ Parent | on HN ]
Re:Ask HN: What do you use for API Key Management? by dsinghvi on Thursday September 29, 2022 @08:26PM (#33029203)
Got it! Based on your comment / some googling it sounds like the common use case is for managing internal secrets.

Do you think it's a good fit if you want to use it for managing API Keys for your public API (you want your customers to generate a key and use it to call your api)? The 10k parameter limit per AWS account might conflict with that usecase.

[ Parent | on HN ]
Re:Ask HN: What do you use for API Key Management? by bosky101 on Friday September 30, 2022 @04:02AM (#33032240)
Kong works well, you can choose from various options like just header api key or a key pair or hmac signature based auth from your clients.
[ Parent | on HN ]
Re:Ask HN: What do you use for API Key Management? by stop50 on Thursday September 29, 2022 @03:34PM (#33025921)
Its part of the authorization. The only thing i can think of is the use of JWT for auth. you log into one and get an jwt and the application checks it.
[ Parent | on HN ]
Re:Ask HN: What do you use for API Key Management? by dsinghvi on Thursday September 29, 2022 @04:22PM (#33026614)
I'm not so much talking about the type of token issued (JWT/Opaque), but more about the service that manages issuing and revoking keys. (i.e. something similar to what Stripe has on their developer portal https://stripe.com/docs/keys).

Was hoping Auth0 had a solution for this but Auth0 but doesn't look like they do: https://community.auth0.com/t/how-to-implement-api-keys-usin..., https://community.auth0.com/t/how-can-i-generate-api-keys-fo...

[ Parent | on HN ]
Re:Ask HN: What do you use for API Key Management? by stop50 on Thursday September 29, 2022 @11:15PM (#33030464)
in most cases i saw in build into the application.
[ Parent | on HN ]
Re:Ask HN: What do you use for API Key Management? by ezekg on Thursday September 29, 2022 @05:52PM (#33027789)
API key authentication is not very hard, and is typically pretty application-specific.

What is stopping you from doing it in-house?

[ Parent | on HN ]
Re:Ask HN: What do you use for API Key Management? by dsinghvi on Thursday September 29, 2022 @06:47PM (#33028371)
It seems like in-house is the way to go since there are no other alternatives.

Things we would have to build:

  - Generating API Keys (with expiry)

  - Storing API Keys securely

  - Revoking API Keys 

  - Adding metadata to API Keys
It seems like there could be a generic API to power all of that, while still enabling applications to be opinionated about whether the incoming request is authenticated and has the right permissions.
[ Parent | on HN ]
Re:Ask HN: What do you use for API Key Management? by jazzex on Thursday September 29, 2022 @08:49PM (#33029414)
Typically an API gateway is behind a lot of these. Lookup KrakenD, Gloo Mesh as examples.
[ Parent | on HN ]
Re:Ask HN: What do you use for API Key Management? by dsinghvi on Thursday September 29, 2022 @09:10PM (#33029583)
Got it -- looks like AWS API Gateway also does this out of the box.
[ Parent | on HN ]