'Monitor frontend API usage
I'm creating a Django API where websites can request data from my API. As this service is paid per use I would like to monitor how often each website requests data from my API. Since requests to my API happen via the frontend (so a javascript function is called on button click that request the data) it is not possible for me to use an id in the request, since this token could be read by anyone and reused. How do other services validate users like this? The Google Maps API for instance. I was thinking of using RSA to encrypt the websites ID and a timestamp that could be used in the request parameters.
Solution 1:[1]
You can try the OAuth2 Authorization Code Flow with PKCE. It uses a code challenge/verifier pattern to avoid having to send secret keys. It was designed for mobile apps which securely store the client secret and was subsequently also recommended for single-page apps which also can't keep them secret.
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|---|
| Solution 1 | mbakereth |