I have a vanilla php api(on a vds) and I want to make data coming from that api available to a few clients that are using a python app that's also written by me. That python app is running on my client/s pc. But now i'm facing a problem: that app can be "pirated".

How do I make sure that the access is limited to only my paid subscribers?

I know that "DRM" or copy protection won't work therefore I was thinking about using tokens that are only available 1 day. And each call will send an Authorization header and based on that the api can decide what to do.

private function check_authorization(){
        $credentials = preg_split('/[\s:]/', trim(Server::get('HTTP_AUTHORIZATION')));

        //try to authenticate the user using those credentials

        return true;
    return false;

Now I was thinking about binding those tokens to 1 IP/day but then there's the dynamic ip and the spoofing problem.

Also I was thinking about using something like Steam way to authenticate new devices for a user: new device? just send a 6 digits code trough email and ask the user to send it over to the api for confirmation. But if i can't identify the device, other than its ip it'll be pretty painful for those clients who happen to be less fortunate and have a dynamic ip.

Should i go as far as checking the operating system, maybe even get the mac and bind my tokens to those macs? Is that even possible?

Thank you!


There is no match between a user—that is a physical person—and an IP address. The same person may have its IP address change on regular basis, even when using a PC. Similarly, multiple users may share the same IP address (for instance multiple persons working in the same company).

Operating system can be spoofed. So does the MAC address, which is relatively easy to change for a virtual machine.

If your goal is to protect your API, issue a certificate per user or use some other sort of authentication, similarly to the way it's done by every per-user API: Amazon AWS, Google APIs, Twilio, PayPal, etc.

What happens on client's machine is not your problem. If a hacker gains access to your user's PC and steals the certificate or credentials in order to access the API on behalf of your user, it's not your business: it belongs to the user to ensure the certificate or the credentials are kept safe. It belongs to you, on the other hand, to be able to reissue a new certificate rapidly once you're alerted that the previous one was stolen.

  • 3
    Don't overcomplicate things upfront. Log accesses to the API so you can see which users have unusual access patterns (widely dispersed IP locations, very high access frequency etc.) and talk to them if you notice something odd. Weigh your cost of implementing a scheme against the possible loss in case of pirating. Would your business suffer? If you've got just a few clients you probably don't need a solution designed for millions of users. – Hans-Martin Mosner Jul 22 at 20:26
  • 1
    One additional idea related to the "friends" issue: you could offer a discount to existing clients who bring new customers. This makes it less attractive to "share" a license (especially when there is a risk of getting caught). – Hans-Martin Mosner Jul 22 at 20:46
  • 1
    The point is that i would like to keep my business small...so yes my business would suffer and implementing a solution won't cost me anything but a little bit of time to code it. But most importantly i developed this software/business to practice and now that i'm gaining some ground i'm trying to learn new things, one of them being this access restriction. – Melody Jul 22 at 22:09
  • 1
    At the end of the day i think i'll do it this way: one user id/token can request one dataset once. I'll log all those calls into a table(user id/token/timestamp/dataset id) and ...so on. Is that a good idea? – Melody Jul 22 at 22:11
  • 1
    It's you who will decide which measures to implement. If you feel more secure with a system that blocks users who seem to abuse your API then go for it. You know your users, and most likely have a good feel for how well-behaved they are. – Hans-Martin Mosner Jul 23 at 7:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.