0

I have an API that is hosted on GCP (no matter if its Compute Eninge, App Engine or any other) and I want to give access to it for selected applications that run outside of my company. I do not need such sophisticated service like Apigee (it is too expensive also), I just want to distinguish applications that call my API and do some individual restrictions for each (like which endpoint they can call).

As I have done some research I think that Cloud Endpoints + API Keys fits my requirements. I could create API Key for each client (API Key is sent in query, so I suppose I can get it in my backend?), but I am a bit confused if it is "the right/recommended" way. As stated here https://cloud.google.com/endpoints/docs/openapi/when-why-api-key#api_keys_provide_project_authorization it should help me to identify project, or rather for my case application, which is communicating with my API, but it feels like its more dedicated for apps that run within my organizations because it can have access to Google services Apis (like I should not give API Key to someone else outside, although I can even restrict IP addresess which can use it).

Would be glad to hear if someone had a smiliar goal and if solved it this way.

eu-saro
  • 11
  • 1
  • 5
  • The setup you described looks pefectly valid for me. What is exactly your concern about it? You can restrict your keys to certain APIs and there shouldn't be access issues I think. – Emil Gi Jul 07 '20 at 13:33
  • @EmilGi Well, in the GCP docs, they generally write that simple API Key token is less secure, as there can be "man in the middle attack" (but services like Apigee or Azure API Management generally work this way - so what the fuss about?), and using Service Accounts is preffered way (but requires client to implement it). – eu-saro Jul 08 '20 at 04:46
  • I guess services like Apigee provide some additional perks, for your use case I think this setup is perfectly valid acoording to [this](https://cloud.google.com/endpoints/docs/openapi/when-why-api-key#when_to_use_api_keys). Otherwise elaborate more please on what you think can go wrong. – Emil Gi Jul 08 '20 at 09:57

0 Answers0