API Security: how to restrict access by domain?

Question

I\'m exposing a simple API and need to make sure only authorized users access it. I will be providing an API key to authenticate. However, I also want to associate the API k

Answer 1

HTTP+SSL is a complex protocol set that supports certificates for both server and the client, and probably could be used in this case, but somehow I feel this would be an overkill.

Answer 2

you want the source IP address

REMOTE_ADDR -or- HTTP_X_FORWARDED_FOR

Answer 3

What kind of API are you exposing? There are many different kinds of APIs - I assume you do not expose your operating system's API...

Assuming you want to expose some web application's API, you may take a look at OAuth, which is based on callback URLs - you can just block certain domains from being called through callback URL.

Read more about OAuth.