Would be nice also to have a topic for how to approach public API authentication and authorization about awesome-authorization HOT 4 CLOSED

I remember Laravel had some features like token "abilities" similar to OAuth scoping of the tokens to access the API.
https://laravel.com/docs/7.x/sanctum#token-abilities

from awesome-authorization.

Oso comes to mind as an amazing resource for this kind of thing https://www.osohq.com they have a mix of supported languages and resources to learn from

from awesome-authorization.

@MrAlekhin - I came across a couple of resources that I think give some good insight into best practices around authn/authz in APIs. I linked them in the list but also linking here:

• Best Practices for Building Secure API Keys - covers some best practices including how to safely generate and store keys, the importance of properly scoping keys and rate limiting, all of which imo is good advice irrespective of which auth approach/framework you adopt.
• Stripe's Approach to API Keys - Stripe has these interesting concepts of publishable (client-side safe) and secret (server-only) keys as well as live/test environments which I think could be useful for anyone building API platforms to adopt.

Hope these are helpful.

from awesome-authorization.

Agreed, thanks for the suggestion! I'll take a pass and try to add something.

from awesome-authorization.