Use Auth0 to secure public api with 3rd party access

[marcelina.barycka]

Hi @trondhindenes ,

The use case you describe seems to be subject to M2M authorization.

@trondhindenes

Api keys should be “ready to use”, and not require jumping through hoops such as replacing id tokens for access tokens, manage token refresh, etc. We want customers to be able to just use an api key header and that’s it

A machine2machine application requests a bearer token intended for the API and your clients can access its resources by just sending a request with the Authorization header and a received Bearer token.

@trondhindenes

Api keys should be long-lived

Maximum value for Token Expiration is 2,592,000 seconds (30 days).

@trondhindenes

API keys will be used for accounting (billing) so it must be possible to identify the api-key used

There are monthly reports of the subscription usage - Monitor Subscription Usage

@trondhindenes

• 1000 api keys during next 2 years (but needs to support more than that too)

The pricing page shows the monthly limits (please uncover the “Compare plans” tab) - Pricing - Auth0

@trondhindenes

I’m wondering if Auth0 has any documentation or use-case for this type of scenario?

One known challenge with this approach is that currently there’s no built-in mechanism to control how often your customers request a new access token for the API. There is a product feature request and you are welcome to upvote. It’s here: Add rate limiting and cache for m2m token authentication endpoints

There’s also a guidance developed by our developers to help with that (it’s downloadable and can be found in this post) - Limit Client requests on Machine to Machine flow - #2 by peter.fernandez

Hope this helps and feel free to reach out with questions!