umm... it's called HTTP-AUTH, and if you really want to be cool, use an
X.509 client cert for authorization (see geoserver as an example that
works very cleanly -
the freebxml registry-repository also uses X.509 based authentication in
a reasonably clean manner)
Robert Sanderson wrote:
> To be (more) controversial...
> If it's okay to require headers, why can't API keys go in a header rather
> than the URL.
> Then it's just the same as content negotiation, it seems to me. You send a
> header and get a different response from the same URI.
> On Mon, Dec 2, 2013 at 10:57 AM, Edward Summers <[log in to unmask]> wrote:
>> On Dec 3, 2013, at 4:18 AM, Ross Singer <[log in to unmask]> wrote:
>>> I'm not going to defend API keys, but not all APIs are open or free. You
>>> need to have *some* way to track usage.
>> A key (haha) thing that keys also provide is an opportunity to have a
>> conversation with the user of your api: who are they, how could you get in
>> touch with them, what are they doing with the API, what would they like to
>> do with the API, what doesn’t work? These questions are difficult to ask if
>> they are just a IP address in your access log.