How to make sure the API request is made from the certain person who can do that?
api, cryptography, javascript, json, php
Solution
Whoever holds that `API_KEY` should be considered "that user", so if you want to keep "atomic" requests (where `api_key` is part of each request, and no request need to depend on previous ones) then you can't really do much about it. But you can try then other approach where you change the way your API works, by getting rid of said "atomicness". In that model it would require any api method to call with `session_key` instead of the `api_key`, and your `api_key` should only be used to generate temporary `session_key` (kind of `login` but for API - say `login` method there). Then all further calls should require session_key `login` returned. In that case you can control (and limit) the number of sessions created with the single `api_key`, or i.e. terminate other sessions if new `login` is called.
Problem
I am creating an API for my website which has lots of information, for say, movies. I want to allow certain number of requests. So, for example, 5$ plan allows 10,000 requests a month. User sign ups, gets the API key and then can make a request like `http://website.com/index.php?api_key=API_KEY&movie=Titanic` and the server gives back the answer in `json`. My question now is, how can I make sure that this API_KEY can be used just by that user? Because if he makes an AJAX request, someone else can see the link with the API_KEY and use it for his project. And I want to allow AJAX requests.