To best explain my context, imagine that I’m creating an alternative piece of software to google analytics (since my personal project’s principle is similar). Each unique user creates an account and needs to place a tracking script on their website so that their website visitor actions can be tracked. Something like this in the head:
<script defer data-domain="testing.com" src=“url/path/to/my/website/script“></script>
The script needs to make an API request to send the data to the server for processing. As the script would be on every page of every customers’ sites, there would be a lot of API requests. I worry that if a customer stops paying but leaves the script on their website, it will still make API requests, hence I need a way of rejecting the API requests.
I’ve been reading around and am trying to figure out the best way of preventing unauthorised use of an API. Ideas that have been raised are using an auth token, API key/secret, and throttling/rate limiting, and tracking IDs for convenience. Would using an auth token be:
- Possible, since assume the user can place their tracking script on their site only once, and JWTs will eventually expire. Would it mean that the script would no longer work? Or could they renew their JWT?
- Necessary, and;
- Required in order to check whether the customer is still paying and decline the API requests if not?
If it is not possible to use an auth token (since it would expire), could the request just use the website URL origin (since each user has a unique website URL), find the user associated with that account, check whether they are a paying customer and decline their API requests accordingly?
Are there any better approaches to this, or any suggestions that anyone has? I wonder what companies like Google etc do.
Presumably even rejecting API requests costs money since my server would have to respond with a 401/403 error, but presumably nothing can be done about this as the script installed on customers’ sites has to have a src attribute that points to the script path on my server. This still concerns me since there could be a large amount of even declined API requests.
Thanks - any suggestions would be much appreciated.