Search code examples
apiauthenticationarchitecturebasic-authentication

API Design: HTTP Basic Authentication vs API Token

I'm currently creating an authentication system on front of a public web API for a web application. Given that each user account has an API key and each request must be authenticated, I have two alternatives:

  1. Using an HTTP Basic Authentication, like GitHub does.

    Requests must be sent to the URL

    http://api.example.com/resource/id
with basic authentication
username: token
password: the api key

  2. Passing the API Token as querystring parameter.

    Requests must be sent to the URL

    http://api.example.com/resource/id?token=api_key

There's also a third option which is passing the token within the URI, but I honestly don't like that solution.

Which solution would you adopt and why?

Solution

  • I think that HTTP Basic Auth should be OK but just for really simple needs.

    The complete (and final) solution IMHO is to implement an OAuth provider. It's not complex, it's a simple protocol and gives you lots of flexibility. In addition it seems to be the current trend as many big players implement it and it's supported from many many libraries.