-1

What I mean by Internal and External API's:

Internal API: will be used by my front-end Apps (Web or Mobile).

External API: will be exposed to developers in order to integrate with my API from their systems.

Who can access my API:

  • My Admin Panel Web App (with multiple roles: Admins, Managers,..).
  • My User Web App (register, generate access tokens, see analytics..).
  • The User third party System (the user custom App that should be integrated with my API).

My question is:

What is the recommended way to authenticate the different types of users (My Web Apps + Users third party Apps)? Please share your solution. Thanks.

|improve this question

closed as too broad by Robert Harvey♦, gnat, Bart van Ingen Schenau, Doc Brown, Erik Eidt Dec 25 '16 at 1:45

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    The obvious answer to the question you asked is "secure the endpoints that need to be secured, using the most appropriate techniques." Did you have a more specific question than that? – Robert Harvey♦ Dec 15 '16 at 17:42
  • Hi, this is a general question I'm expecting a full solution answer, I don't want to ask all the questions in my head and what's exactly confusing me.. I just want see how everyone else is doing such task, the more details they provide the better, despite what I currently have and if it's a right or wrong way. – Mahmoud Zalt Dec 15 '16 at 18:19
  • related question - secure services with OAuth - softwareengineering.stackexchange.com/questions/337579/… – linuxunil Dec 15 '16 at 18:47
  • 1
    Are you sure you wouldn't rather buy a book or take a class? You've chosen the hardest possible way to do this: asking random strangers on the Internet for a comprehensive tutorial. – Robert Harvey♦ Dec 15 '16 at 19:20
  • Your suggestion is funny :D they never teach us anything at class. And to find that chapter in an unknown book it will take me a month at least. So yes asking a strangers for recommendations is my preferable option so far. Simply if you don't know the answer because you skipped that class or you missed that book, skip the question and don't waste anyone's time to reading your suggestions. – Mahmoud Zalt Dec 19 '16 at 17:34
1

JSON Web Tokens (JWT) is a way that I have secured API's in the past.

A consumer of the API would need to have a token, and would send that token with every request.

It would be up to the API to receive the token and determine if it is valid or not.

The details of the token (how it is generated, how long it is valid, etc) are implementation details that would be up to you.

|improve this answer
  • 1
    Thanks for your time to answer my question. But this is not the kind of answers I'm looking for. I'm already using JWT for authentication, my question is mainly about authenticating different types of apps, My Apps and the User Apps. – Mahmoud Zalt Dec 19 '16 at 17:36

Not the answer you're looking for? Browse other questions tagged or ask your own question.