How do you set up an API key system for your website?

Question

Let say that I have a website with some information that could be access externally. Those information need to be only change by the respected client. Example: Google Analytic or WordPress API key. How can I create a system that work like that (no matter the programming language)?

Answer 1

A number of smart people are working on a standard, and it's called OAuth. It already has a number of sample implementations, so it's pretty easy to get started.

Answer 2

Here is a document on API design.

Answer 3

Simple:

1. Generate a key for each user
2. Deny access for each request without this key

Answer 4

Currently, I use a concatenation of multiple MD5s with a salt. The MD5s are generated off of various concatenations of user data.

Answer 5

A good way of generating a key would be to store a GUID (Globally Unique Identifier) on each user record n the database. GUID is going to be unique and almost impossible to guess.

Answer 6

There are also infrastructure services that manage all this for you like http://www.3scale.net (disclosure I work there), http://www.mashery.com and http://www.apigee.com/.