How to have my callbacks authenticated in a REST app?

Question

I'm developing a REST application and I allow my clients to authenticate in several ways (typically using Authorization: Token ... as in OAuth 2.0, but also there's session-based auth option for the web-browsable API). The application allows the client to provide their endpoint to which my application would later POST with some data whenever a particular event happens.

Now I wonder: what's the best way for the client application to authorise that it's my application calling?

Should I roll something up myself (like, include a token derived from the client application secret, which the client app would then verify), or is there a more conventional approach I can follow?

Answer 1

The API is yours, so it is up to your clients to adapt to it, not the other way around.

If some of your clients require authentication on their https://client.app.com/callback-for-youapp I think they'd have to figure that by themselves. For example they could include a token when calling you so that when you call them back they can authenticate your call ex :

Your client subscribing: POST https://your.app.com/subscriptions { "...": "..." "callback": "https://client.app.com/callback-for-youapp?token=xyz" } So when your are calling back on https://client.app.com/callback-for-youapp?token=xyz They can authenticate your request using the token in the query string.

Answer 2

If your clients are other teams in your company, producing services in the same cloud platform account such as AWS or Google Cloud, then you can probably use your cloud provider's built in IAM solution as usual. Example: https://cloud.google.com/workflows/docs/creating-callback-endpoints#call-endpoint

Otherwise (e.g. if your clients are on the public internet), you could require your clients implement any kind of authentication that a server would normally use.

• For example, you could make your clients register an OAuth endpoint and client ID / client secret with you, and then you authenticate to them using that information which they provided you. Instacart Connect does this: https://docs.instacart.com/connect/api/authentication_webhooks/

• Or, you could make them give you an api key, and then send that api key on each callback.

• Or, you could use client certificate authentication. Since your service is the client in the case of a callback, you can provide your public certificate to them during integration, and expect them to check that each callback is valid against the certificate.