I'm developing an internal API using Flask, although due to limitations with our platform the endpoints will be accessible over the public internet. It will only have a very small number of users and it's not likely that this will increase much in the future. They will query the service programatically from a backend.
As only a small number of users will be consuming the API I think it makes sense to have a single key that can be used to access it. This will keep the authentication process simple and as the API doesn't provide access to anything really sensitive I don't believe we need to go too extreme on security. I've written the following:
import yaml config = yaml.safe_load(open('config.yml'))
from functools import wraps from flask import request from app_config import config def valid_auth(func): @wraps(func) def func_wrapper(*args, **kwargs): if 'x-api-key' not in request.headers: return("Credentials not present in request", 401) elif request.headers['x-api-key'] != config['api_key']: return ("Credentials not valid", 401) else: return func(*args, **kwargs) return func_wrapper
import api_module as api from flask import Flask, request from auth import valid_auth app = Flask(__name__) @app.route('/route1') @valid_auth def api_function(): #do api stuff here
Essentially the process is:
- API key is stored in config.yml on API server
- (SSL) Request from backend includes the key in a header called x-api-key
- A wrapper function checks that the key sent in this header matches the key in the configuration before executing any API functions. If not, the user gets an error.
Does this seem like a reasonable approach to authentication for an internal API that will be used by a small number of users and that doesn't provide access to any sensitive information? Any general suggestions for how this process might be improved?