Micro APIs for Everyday Use • Hacker News Board

Re: Micro APIs for Everyday Use

#31

Post by [deleted] » Thu, Jun 24, 2021, 6:44 PM UTC

mana72 wrote: post #30

I like this. How different are you from Abstract API ( https://www.abstractapi.com ) though?

[deleted]

Re: Micro APIs for Everyday Use

#32

Post by transitivebs » Thu, Jun 24, 2021, 7:35 PM UTC

Love the initiative; I'm sure you'll run into some of the same lessons that I've learned building Saasify: https://transitivebullsh.it/saasify-vc-feedback

Happy to chat further about this space if you're interested && keep up the great work building for devs

Re: Micro APIs for Everyday Use

#33

Post by pbreit » Thu, Jun 24, 2021, 7:43 PM UTC

Could someone explain to me this whole movement towards "Bearer" authentication? I understand it in an Oauth context and using JWTs. I don't really understand it with simple API keys. What is the point of prefixing and API key with "Bearer "?

Re: Micro APIs for Everyday Use

#34

Post by detaro » Thu, Jun 24, 2021, 7:46 PM UTC

pbreit wrote: post #33

Could someone explain to me this whole movement towards "Bearer" authentication? I understand it in an Oauth context and using JWTs. I don't really understand it with simple API keys. What is the point of prefixing and API key with "Bearer "?

An Authorization header value is defined to be a pair of type and the actual authentication/authorization information. "Bearer" works, so why make up something else?

Re: Micro APIs for Everyday Use

#35

Post by tobyjsullivan » Thu, Jun 24, 2021, 8:00 PM UTC

pbreit wrote: post #33

Could someone explain to me this whole movement towards "Bearer" authentication? I understand it in an Oauth context and using JWTs. I don't really understand it with simple API keys. What is the point of prefixing and API key with "Bearer "?

      A security token with the property that any party in possession of
      the token (a "bearer") can use the token in any way that any other
      party in possession of it can.  Using a bearer token does not
      require a bearer to prove possession of cryptographic key material
      (proof-of-possession).

I think most people interpret that definition as including API secret keys. I’d be curious to hear any alternative suggestions as I run into this fairly regularly.

https://datatracker.ietf.org/doc/html/rfc6750#section-1.2

Also relevant: https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentica...