Search code examples
wcfbasic-authenticationwcf-web-api

API key authentication and user authentication best pratice

Can someone guide me on the best practice for this situation;

I have a REST service which developers can access with an API KEY. (I have this working in the WCF WEB API), so this part is done.

I would like developers to be able to validate a USER. i.e. use REST to check the username and password entered by a user.

Each of the end point methods only needs API KEY authentication, rather than basic authentication on the method call (if you see what I mean).

How should I best implement this?

Phil.

Solution

  • To securely send password data to a RESTful service you will need to secure communications across http. There are loads of ways to do this, see this post here: How to secure RESTful web services?