API Keys vs HTTP Authentication vs OAuth in a RESTful API

Question

I\'m working on building a RESTful API for one of the applications I maintain. We\'re currently looking to build various things into it that require more controlled access a

Answer 1

It depends on your needs. Do you need:

• Identity – who claims to be making an API request?
• Authentication – are they really who they say they are?
• Authorization – are they allowed to do what they are trying to do?

or all three?

If you just need to identify the caller to keep track of volume or number of API Calls, use a simple API Key. Bear in mind that if the user you have issued the API key shares it with someone else, they will be able to call your API as well.

But, if you need Authorization as well, that is you need to provide access only to certain resources based on the caller of the API, then use oAuth.

Here's a good description: http://www.srimax.com/index.php/do-you-need-api-keys-api-identity-vs-authorization/