On most API's such as facebook and bebo to use there API you must get a Key and secret, I am just wondering what is some good methods of doing a system like this. I will be using PHP/MysQL.
How can I basicly verify a user key and secret are ok when there app sends there API request? I was thinking of storing them in mysql, which I will have them stored there no matter what but I was wondering if there is some other method that is better for the verification process, instead of hitting the DB on every single API hit?
If the key is an encrypted form of the domain and secret they're using, you wouldn't need to hit the db to verify them.
if ($key != encrypt($domain . $secret))
// die
Cache the auth info in memcached and you'll save reads in the db.
you'll need somewhere to keep the key/secret combo. i think its impossible not to have a db hit unless you use some sort of caching like memcached.
in regards to they key/secret implementation, several places use a public/private key combo. you encrypt they data with the private key, then send it across where it's decrypted with the public key (or vice versa). I think the openssl package has this functionality.
http://php.net/manual/en/book.openssl.php
-d
