Ask HN: What do you use for API Key Management? | Hacker News Reader

Ask HN: What do you use for API Key Management?

7 pointsdsinghvi11 comments

Many developer portals allow you to generate API Keys. Is there a SaaS service that is powering these or is all of that logic being built in-house?

View on HN

https://disq.us/url?url=https%3A%2F%2Fdigitalce.com%2Fblog%2...

If you're using AWS parameter store is pretty good! You can set permissions, have different keys for different environments, and lock them with keys. If you need more advanced functionality there are other options too.

Got it! Based on your comment / some googling it sounds like the common use case is for managing internal secrets.

Do you think it's a good fit if you want to use it for managing API Keys for your public API (you want your customers to generate a key and use it to call your api)? The 10k parameter limit per AWS account might conflict with that usecase.

Its part of the authorization. The only thing i can think of is the use of JWT for auth. you log into one and get an jwt and the application checks it.

I'm not so much talking about the type of token issued (JWT/Opaque), but more about the service that manages issuing and revoking keys. (i.e. something similar to what Stripe has on their developer portal https://stripe.com/docs/keys).

Was hoping Auth0 had a solution for this but Auth0 but doesn't look like they do: https://community.auth0.com/t/how-to-implement-api-keys-usin..., https://community.auth0.com/t/how-can-i-generate-api-keys-fo...

in most cases i saw in build into the application.

Kong works well, you can choose from various options like just header api key or a key pair or hmac signature based auth from your clients.

API key authentication is not very hard, and is typically pretty application-specific.

What is stopping you from doing it in-house?

It seems like in-house is the way to go since there are no other alternatives.

Things we would have to build:

  - Generating API Keys (with expiry)

  - Storing API Keys securely

  - Revoking API Keys 

  - Adding metadata to API Keys

It seems like there could be a generic API to power all of that, while still enabling applications to be opinionated about whether the incoming request is authenticated and has the right permissions.

Typically an API gateway is behind a lot of these. Lookup KrakenD, Gloo Mesh as examples.

Got it -- looks like AWS API Gateway also does this out of the box.

Reply on news.ycombinator.com