How can I connect to API securely?

I've been exposed to mostly API to browser or server. But not API to API.

I want to create API through which server 1 and 2 can talk. But I want them to be authenticated. Meaning it has to sure that connection is coming via authorized place.

I can use SSL request and then send long unique id. which seems easiest.

I could use some complicated OAuth... but since both sides are me why bother with scope.

I could make domain API url very long and not guessable and keep that a secret which only my main server would know and will use to connect. Similar to step 1, even easier.

All will needs SSL..

For a good balance of low-but-not-absent security but much-lower-than-oauth complexity, you could use a simple API key as an authentication token.

  • tokens should be pseudorandom and generated with an appropriate crypto library. For example: require("rand-token").generator({source: "crypto"}).generate(20);
  • tokens must obviously be kept secure and secret (tight filesystem permissions on the servers, don't check them into git, don't send them over plaintext HTTP, etc)
  • each server should be able to validate a token (like from it's own database), and delete/revoke them if they are compromised.
  • other than that the tokens function similarly to username/password credentials in a traditional web app sense, although you probably want to include them in every request header and not need sessions nor session cookies. I have used a header such as Authorization: key abababababababa....

I'd start with that. There's a lot more stuff you could gradually add over time as warranted by the status of your project, ending up with all the additional bells and whistles oauth2 and other high-grade systems provide such as temporary expiring tokens, replay protection, rate limiting, hashed and signed parameters, refresh mechanisms, granular permissions, etc.