security - Secure API calls from partner website -


at company i'm working we're building system needs allow api calls users website.

this have thought far:

  1. the user register website our system.

  2. the system generates token put in file on user server (or similar) in order verify website owned user.

  3. the user presses verify button make our system check token present @ predefined location.

  4. if token matches 1 saved in our database website verified , server informations such ip , domain name saved in database in order allow requests system api.

what alternatives in order allow api calls user's website in easy way user? can done improve , secure flow?

the workflow ended using following:

  1. the user registers website on our platform , ip address fetched , saved.
  2. the app generates website api user , verification code.
  3. from moment website allowed log in website api user using authorization code should copied , saved on client server.
  4. the client server, once logged in, receives jwt can used make additional requests.

hope may come in handy other people to.


Comments

Popular posts from this blog

serialization - Convert Any type in scala to Array[Byte] and back -

matplotlib support failed in PyCharm on OSX -

python - Matplotlib: TypeError: 'AxesSubplot' object is not callable -