API安全 - 使用api密钥秘密，哈希，tnonce等VS. SSL证书验证

Question

Why is it required to protect API calls with additional API key secret and sign API call?

Sending only one API key over SSL connection should be enough to protect requests IMHO.

Is it because some clients will be unable to make https connections (or verify server cert.) and API should cater to them, or there is another reason?

Most API's require using 2 API keys: API key and API key secret, also tnonce (UNIX timestamp) and then sign API call using some hashing algorithm. Is it really so necessary since every call is made over SSL?

Answer 1

For many web APIs, a developer is required to obtain an API key that they must use with all their API requests. The uses I've seen are generally not for security reasons (thus SSL doesn't replace the need for the API key), but rather are used to track which API requests belong to which developer.

This is even more important when the API requests are coming from javascript in a web page because in that cases, the IP address of a given request will belong to the end-user, not the developer so IP address tracking is not very useful. But, the API key will identify which developer the request belongs to even when made by an end-user browser from a web app. Then, if there are problems with the use of the API, the host site can know who is behind the problem requests and then either contact that developer or shut down or moderate access for that particular developer without affecting other users of the API who are not causing an issue.

Thus, the API key facilitates monitoring and managing the use of the API by different developers. In some APIs, a developer is asked to obtain a separate API key for each "app" that they are using the API for to provide even further granularity and control.

In some cases, I've even had a host site contact me (the developer using an API key) and suggest a more efficient way for me to use their API to get the data I wanted (presumably because this took less load on the site's back-end servers).

In particularly bad cases where an API is being misused or used for illicit purposes, an API key can be revoked by the host site such that it no longer works (all requests using that API key are rejected).