0

I'm working with a project that uses ASP.NET Core 2.2. The main solution contains different projects, including APIs for a mobile application, APIs to integrate the system with third parties, a web application, etc.

  1. Mobile API - For internal application
  2. Public API - To integrate our system with others
  3. Web - Website

We're using token-based authentication for mobile API project. However, to expose our Public APIs for third parties, we don't want to use token-based authentication, instead, we decided to use the key - secret.

But the issue is that another project (integration to use our system internally) has its registered users and they don't want to create an account in our system. I suspect that, in this case, key-secret things wouldn't work. We currently use api-key for every project(tenant), and they have to keep api-key for their users. However, this could create security issues if we expose API endpoints publicly.

Along with this, we'd like to track request per user too.

What type of authentication solves this problem? and how can we handle such a scenario?

  • Thanks @Ewan! but the pinned question wanted to use JWT authentication in a custom way, however, in this case, I ask about best fit authentication approach. – Div Jan 3 at 10:41
  • However, to expose our Public APIs for third parties, we don't want to use token-based authentication, Why? – Laiv Jan 3 at 10:45
  • We currently use api-key for every project(tenant), and they have to keep api-key for their users. However, this could create security issues if we expose API endpoints publicly. How could create security issues? – Laiv Jan 3 at 10:47
  • 1
    That's ok and for the sake of the multitenancy you should not change the rules now or the economy of scale starts to blur. – Laiv Jan 3 at 10:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.