 |
 |
umm... it's called HTTP-AUTH, and if you really want to be cool, use an X.509 client cert for authorization (see geoserver as an example that works very cleanly - http://docs.geoserver.org/latest/en/user/security/tutorials/cert/index.html; the freebxml registry-repository also uses X.509 based authentication in a reasonably clean manner) Robert Sanderson wrote: > To be (more) controversial... > > If it's okay to require headers, why can't API keys go in a header rather > than the URL. > Then it's just the same as content negotiation, it seems to me. You send a > header and get a different response from the same URI. > > Rob > > > > On Mon, Dec 2, 2013 at 10:57 AM, Edward Summers <[log in to unmask]> wrote: > >> On Dec 3, 2013, at 4:18 AM, Ross Singer <[log in to unmask]> wrote: >>> I'm not going to defend API keys, but not all APIs are open or free. You >>> need to have *some* way to track usage. >> A key (haha) thing that keys also provide is an opportunity to have a >> conversation with the user of your api: who are they, how could you get in >> touch with them, what are they doing with the API, what would they like to >> do with the API, what doesn’t work? These questions are difficult to ask if >> they are just a IP address in your access log. >> >> //Ed >>