I have an implementation for an internal API, the requirement is to implement some sort of basic authentication instead of oauth (generating a token).

Do you think there’s any difference between using just an API key vs using a client id + secret?
For what I see it’d be just like saying “using a password” vs “using a user and a password”.

  • hallettj@beehaw.org
    2·
    1 year ago

    For what I see it’d be just like saying “using a password” vs “using a user and a password”.

    As long as API keys have more entropy than typical username & password combinations they can be more secure. Imagine if you had a system where you make a token by concatenating username and password - the security properties don’t change just because you’re exchanging one string instead of two separate ones.