For learning purposes, I'm trying to build an Expense Tracker web-app from scratch. I'm in the process of designing it before coding it. I decided to attempt to make it a Headless Web-app: The main server will only have an API and the client will query it to render content. This means I can use the same API for mobile apps and websites.

Now I've come across an interesting dilemma:

  • How do I authenticate this API? I shouldn't ask for username and password every time I request something.
  • Do I use API keys? If so, how often do I renew them? Are they temporary or permanent?
  • If I want to make a public API, how do I distinguish the regular user from someone using the API?

Also please let me know if my idea is flawed, I'm open to suggestions and changes.

Thank you!

  • 1
    Unless for some reason you're also looking to learn how to build your own authentication mechanism (not a very useful learning exercise IMO), I'd suggest looking into one of the many existing free OAuth providers out there (Start with the provider's documentation and go from there). Unless there happens to be some extremely niche and unusual requirement, it's rare for anyone building web services to also find themselves creating their own authentication mechanism because such efforts generally amount to a lot of work re-inventing the wheel with no benefit. Jan 10, 2021 at 14:07
  • I'm definitely not trying to build my own authentication, I will leave that problem to experts. It's more about "what" I should use, or "how" to approach it. I will read a little more about OAuth, thanks! Jan 10, 2021 at 20:40


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.