We are in the beginning phases of an effort to expose our data via API to our business partners. There is a discussion going on about how to best authorize use of the API. Specifically, do we provide the business entity with a token/key/whatever that is used in each request to the API, or do we require that any employees at the entity provide a username/password. It should be noted that we will be billing the entity on a per access level, and that the entity will be developing their own applications to use this api - we are not providing a full-blown application (API only).
I am more in favor of providing a entity level key, and on our side we simply track the entity's usage as an aggregate. I feel this would be most palatable to the IT dept of the entity. The argument for having each individual user provide credentials is to be able to report to the entity which user used up their allotment of requests.
I'd love some feedback and any anecdotal backing to one position or the other.
Some additional thoughts:
The idea is that the entity will be developing their own applications and it is those applications that will ultimately make calls to our API.
- This would allow the entity to track usage by user if they so wish.
- We wouldn't want to impose too many design mandates for their applications (e.g. you need to ask your users to provide two usernames/passwords)
There are possibly 1000's of end-users. This could be a maintenance/admin nightmare. As their users come and go.
I would imagine that these entities may balk at the idea that their users will have username/password information on our systems. Users often use the same username/password. Will we enforce password policies that meet the entity's requirements.
Obviously, I hope to hear some feedback that supports my position and can help me promote it here, but I am not too proud to hear some arguments for the other (or some third, fourth) position. I need what's best not what's mine.