How to use a key and secret for verification?

Question

On most API's such as facebook and bebo to use there API you must get a Key and secret, I am just wondering what is some good methods of doing a system like this. I will be using PHP/MysQL.

How can I basicly verify a user key and secret are ok when there app sends there API request? I was thinking of storing them in mysql, which I will have them stored there no matter what but I was wondering if there is some other method that is better for the verification process, instead of hitting the DB on every single API hit?

Answer 1

you'll need somewhere to keep the key/secret combo. i think its impossible not to have a db hit unless you use some sort of caching like memcached.

in regards to they key/secret implementation, several places use a public/private key combo. you encrypt they data with the private key, then send it across where it's decrypted with the public key (or vice versa). I think the openssl package has this functionality.

http://php.net/manual/en/book.openssl.php

-d

Answer 2

If the key is an encrypted form of the domain and secret they're using, you wouldn't need to hit the db to verify them.

if ($key != encrypt($domain . $secret))
    // die

Answer 3

Cache the auth info in memcached and you'll save reads in the db.