The rapid rise of APIs in recent years isn’t entirely good news. APIs are often the weakest link when it comes to cybersecurity, which is vaguely ironic as APIs deliver more digital assets than any website or eCommerce portal. If you’re not careful, APIs can be a major security risk.
Even worse, APIs are known for their shortcomings. This means that even more cyber-criminals are finding new ways to target APIs and exploit their security weaknesses. As a result, 91% of enterprises experienced some sort of API security incident in 2020.
If you’re serious about working with APIs, you’ve got to consider API security. API tokens are one of the most popular methods that API developers are adopting to ensure their API assets are as secure as possible.
To help you get started with API tokens, we’ve put together a thorough guide, with everything you’d ever want to know about using API tokens.
Your Guide To API Tokens
Let’s start with a definition. What is an API token, exactly? API tokens, which are sometimes called access tokens, are small collections of code with pertinent info about a user. Even though these snippets are tiny, they can contain a lot of data.
API tokens are usually device-specific, as well. A user might need to get one API token for their smartphone and another when they sign in on their desktop. This benefits the provider and user, keeping their accounts as secure as possible.
API tokens can sometimes be extended, also. This is most often seen with social logins, where you can sign in with your Facebook or Google login, for example.
Elements Of API Tokens
API tokens transmit a lot of data with just a few bytes. The most common structure for an API token is:
- Header
- Payload
- Signature
The header lets the API know what format the token is in, so it knows what to expect. The payload, or body, contains all of the relevant user data, including permissions and expirations.
The signature contains all of the data for user verification. Signatures are usually hashed, which makes them difficult to counterfeit.
The payload is the most important part of the API token. It’s essentially a passkey for the API. A particular API resource will require a certain asset in the API token payload. If it’s not there or is incorrect, the caller won’t be able to access that resource.
On the developer side, API developers can customize how a token is received. For example, Google allows access to nine different resources with one token. A site can have different types of tokens, also. Facebook offers four different types of tokens, for instance.
How API Tokens Work
API tokens work very similarly to APIs. Like an API, an API token delivers a payload in a predetermined format. Think of the API as a lock with the API token having the necessary grooves to turn the tumblers.
An API token follows a set series of steps. First, the API verifies the username and password from the payload. Once these are verified, the API sends an asset to your browser to be stored. Then anytime you send a query to the API, the access token is sent along with it. It functions as a handshake that ensures the API will stay unlocked for you for as long as the token is valid.
Single sign-on (SSO) tokens can be issued as well. One typical example of SSOs in action is the multi-site authentication scenario we mentioned earlier. For instance, you might use your Facebook login to log into a 3rd-party API. These tokens don’t tend to stay active for very long, however. Sometimes they only remain valid for as little as 10 minutes.
0Auth 2.0 API Tokens
Modern API security is possible thanks to the 0Auth 2.0 standard. Whereas 0Auth is flashy, with a flashy dashboard and easy implementation, 0Auth 2.0 is the real cause for celebration. 0Auth 2.0 was created to remedy some of the shortcomings of 0Auth 1.0. The new standard is better suited for mobile and working with APIs, specifically.
0Auth 2.0 is essential for ensuring an API is truly secure. No sensitive information is exchanged when you use 0Auth 2.0. That’s where API tokens come into play. Sensitive information like credit card information, login credentials, and passwords are stored on an external server.
0Auth 2.0 means that both API producers and consumers can trust one another without compromising sensitive information. For an illustration, think about eCommerce when there were no standardized payment protocols. In those days, you might have had to email your credit card number to a retailer and hope for the best.
0Auth 2.0 API tokens are good for the end-user, too. They make logins easy and painless. It also offers greater control over the user’s data, which is especially important given the unethical data usage of recent years.
0Auth 2.0 uses a Secure Socket Layer (SSL) to ensure data protection and privacy. SSL uses the latest, most powerful cryptography protocols to ensure data security. Access is then allowed via API tokens. 0Auth 2.0 API tokens are also easier to revoke if something goes wrong.
One of the best things about API tokens becoming more mainstream is that there are many tools for you to use and learn from. You won’t have to waste your time reading through documentation and waiting on tech support, so you can focus on doing what you actually want to be doing.
OAuth.Tools by Curity is a fully-fledged OAuth playground that lets you generate code for everything from JWTs to custom workflows. If you just want to generate your token and be done with it, you can simply save OAuth.tools in your bookmark bar for moments when you need to create an API token.
OAuth.tools is a great resource and introduction to the world of API tokens as it’s designed to be platform-agnostic. Many of the other API token providers are designed for a specific product, so you only learn how to use that particular resource. Getting familiar with OAuth 2.0 here means you can apply these principles to any situation!
Once you’ve generated an API token or JWT, you can test it straight from the Playground. You just have to create an environment, and it generates endpoints, public keys, metadata, and anything else you might need to make sure your tokens are working.
The code snippets are handy, too, if you want to roll up your sleeves and really get into API tokens. It’s definitely useful to have real-world examples to base your work on.
API Token Providers
Given the increasing need for API security, it’s little surprise that there are many apps and services you can use to generate API tokens if you don’t feel like coding them your own.
Some other API token providers include:
API Tokens Best Practices
As we’ve already seen, there are numerous approaches to issuing and consuming API tokens. Each approach has its strengths and potential drawbacks. Here are a few things you can think of when you’re deciding which format is suitable for your API.
If you’re issuing a token for an end-user application, an OAuth2.0 API token is your best bet, due to its ability to interact with a resource server.
If your API is intended to be used as a service for other applications, you should use a simple API token. This is the best approach for any application that involves automation. Stripe, Twilio, or SendGrid are examples of this approach.
If you’re using the token-based method, you should include all necessary authentication data in an Authorization: Bearer object in the JSON file. Instead of using a simple string-based authenticator, use the JWT format we talked about earlier. JWT has become widespread, so most programming languages and frameworks can decode it.
Examples of API Tokens In Practice
In order to fully understand API tokens, let’s look into some examples of API tokens in production. For instance, OAuth 2.0 and an access token are required to access Google APIs. You insert the necessary scopes into the access token and refresh the access token when it expires, if necessary. Google provides a helpful playground where developers can select the appropriate API, assign scopes, generate tokens, and test sample HTTP requests.
Another example of when API tokens are used is within open banking. For instance, an API token is required when authorizing with Nordea’s open banking API catalog. In order to access these APIs, an access token is sent to the server within the request header. This token is then used to authenticate and authorize the client.
Lastly, API tokens are also utilized frequently to help authorize permissions within a zero-trust architecture. Internally-deployed cloud-native DevOps tools, for example, need to authorize the correct scopes to ensure a least privilege model is followed at all times. One example is the Azure DevOps Services REST API. This service enables read and write capabilities and accepts an authorization header where the client can insert a bearer token that describes the client’s authorization information.
API Tokens: Final Thoughts
APIs are not going anywhere. This means we need to come to terms with API security to make sure our API products are safe and secure so we can use them with an easy conscience. These precautions need to be easy to use with little effort, though, or people won’t use our API products.
API tokens take care of so many of these issues for us with one ingenious method. They’re also customizable, with numerous configurations for everyone from casual users to your dedicated audience.
API tokens are also essential for data privacy and security. Considering that these are some of the most pressing issues facing our remote economy, you should definitely know how to use API tokens as part of your development toolbox.
