Many developer portals allow you to generate API Keys. Is there a SaaS service that is powering these or is all of that logic being built in-house?
Ask HN: What do you use for API Key Management?
1–10 of 13 posts
Re: Ask HN: What do you use for API Key Management?
#2Its part of the authorization. The only thing i can think of is the use of JWT for auth.
you log into one and get an jwt and the application checks it.
Re: Ask HN: What do you use for API Key Management?
#3Its part of the authorization. The only thing i can think of is the use of JWT for auth. you log into one and get an jwt and the application checks it.
I'm not so much talking about the type of token issued (JWT/Opaque), but more about the service that manages issuing and revoking keys. (i.e. something similar to what Stripe has on their developer portal https://stripe.com/docs/keys).
Was hoping Auth0 had a solution for this but Auth0 but doesn't look like they do: https://community.auth0.com/t/how-to-implement-api-keys-usin..., https://community.auth0.com/t/how-can-i-generate-api-keys-fo...
Re: Ask HN: What do you use for API Key Management?
#4API key authentication is not very hard, and is typically pretty application-specific.
What is stopping you from doing it in-house?
Re: Ask HN: What do you use for API Key Management?
#5API key authentication is not very hard, and is typically pretty application-specific. What is stopping you from doing it in-house?
It seems like in-house is the way to go since there are no other alternatives.
Things we would have to build:
- Generating API Keys (with expiry)
- Storing API Keys securely
- Revoking API Keys
- Adding metadata to API Keys
Re: Ask HN: What do you use for API Key Management?
#6If you're using AWS parameter store is pretty good! You can set permissions, have different keys for different environments, and lock them with keys. If you need more advanced functionality there are other options too.
Re: Ask HN: What do you use for API Key Management?
#7If you're using AWS parameter store is pretty good! You can set permissions, have different keys for different environments, and lock them with keys. If you need more advanced functionality there are other options too.
Got it! Based on your comment / some googling it sounds like the common use case is for managing internal secrets.
Do you think it's a good fit if you want to use it for managing API Keys for your public API (you want your customers to generate a key and use it to call your api)? The 10k parameter limit per AWS account might conflict with that usecase.
Re: Ask HN: What do you use for API Key Management?
#8Typically an API gateway is behind a lot of these. Lookup KrakenD, Gloo Mesh as examples.
Re: Ask HN: What do you use for API Key Management?
#9Typically an API gateway is behind a lot of these. Lookup KrakenD, Gloo Mesh as examples.
Got it -- looks like AWS API Gateway also does this out of the box.
Re: Ask HN: What do you use for API Key Management?
#10Its part of the authorization. The only thing i can think of is the use of JWT for auth. you log into one and get an jwt and the application checks it.
I'm not so much talking about the type of token issued (JWT/Opaque), but more about the service that manages issuing and revoking keys. (i.e. something similar to what Stripe has on their developer portal https://stripe.com/docs/keys ). Was hoping Auth0 had a solution for this but Auth0 but doesn't look like they do: https://community.auth0.com/t/how-to-implement-api-keys-usin... , https://community.auth0.com/t/how-c…
in most cases i saw in build into the application.