-1

What I mean by Internal and External API's:

Internal API: will be used by my front-end Apps (Web or Mobile).

External API: will be exposed to developers in order to integrate with my API from their systems.

Who can access my API:

  • My Admin Panel Web App (with multiple roles: Admins, Managers,..).
  • My User Web App (register, generate access tokens, see analytics..).
  • The User third party System (the user custom App that should be integrated with my API).

My question is:

What is the recommended way to authenticate the different types of users (My Web Apps + Users third party Apps)? Please share your solution. Thanks.

Improve this question
5
  • 2
    The obvious answer to the question you asked is "secure the endpoints that need to be secured, using the most appropriate techniques." Did you have a more specific question than that?
    – Robert Harvey
    Dec 15 '16 at 17:42
  • Hi, this is a general question I'm expecting a full solution answer, I don't want to ask all the questions in my head and what's exactly confusing me.. I just want see how everyone else is doing such task, the more details they provide the better, despite what I currently have and if it's a right or wrong way.
    – Mahmoud Zalt
    Dec 15 '16 at 18:19
  • related question - secure services with OAuth - softwareengineering.stackexchange.com/questions/337579/…
    – linuxunil
    Dec 15 '16 at 18:47
  • 1
    Are you sure you wouldn't rather buy a book or take a class? You've chosen the hardest possible way to do this: asking random strangers on the Internet for a comprehensive tutorial.
    – Robert Harvey
    Dec 15 '16 at 19:20
  • Your suggestion is funny :D they never teach us anything at class. And to find that chapter in an unknown book it will take me a month at least. So yes asking a strangers for recommendations is my preferable option so far. Simply if you don't know the answer because you skipped that class or you missed that book, skip the question and don't waste anyone's time to reading your suggestions.
    – Mahmoud Zalt
    Dec 19 '16 at 17:34
1

JSON Web Tokens (JWT) is a way that I have secured API's in the past.

A consumer of the API would need to have a token, and would send that token with every request.

It would be up to the API to receive the token and determine if it is valid or not.

The details of the token (how it is generated, how long it is valid, etc) are implementation details that would be up to you.

Improve this answer
1
  • 1
    Thanks for your time to answer my question. But this is not the kind of answers I'm looking for. I'm already using JWT for authentication, my question is mainly about authenticating different types of apps, My Apps and the User Apps.
    – Mahmoud Zalt
    Dec 19 '16 at 17:36

Not the answer you're looking for? Browse other questions tagged or ask your own question.