How Can I Authenicate Users of my API

Question

A website that I co-own has been asked us to add some content to our site which is great advertising for us. The catch is that because of the nature of our company, we have to be very careful about who has access to our site. (We distribute music for labels to radio stations)

Following so far?

So I have started a new page for the content. I think I want to have some kind of hashed string with the calling site name, a key for our site and maybe the date, encrypted and included in the query string or cookie being sent from the calling site. The goal would be to prevent this from being called from other sites (their site is password protected as well), including DNS spoofing to trick my site to think it is being requested from that site.

So I think this is a good solution.

1. Is it? If not, what should I try instead?
2. How the heck do I do that? I think I would have the API called inside an iFrame on their site, with the source as my site and page with the query string, but how should I get the calling site URL? And what should I use to encrypt the query string key?

Answer 1

You can require SSL connections and hand out certificates from your server that you require your clients to use to validate their identities. This would be the simplest approach.

EDIT

It occurs to me I'm unsure if you're worried about someone trying to use someone else's account or if your service is supposed to be paid for on a domain basis.

You really can't protect against the latter as, anyone who's determined enough can simply create their own API to interface with yours in a valid context and call it from any other site they wish to propagate the information to.

Answer 2

I would recommend using Public key cryptography. For each user, generate a public key which you send them, and a private key for your records.

They should encrypt the current time along with other self-identifying information like IP address. Then when you receive the handshake, you can decrypt it using the private key, and then verify the time is not too far off, the IP address is correct etc.