Codeigniter, Restful API & How to use Keys

Question

I am using Phil Sturgeon's & Chris Kacerguis Restful server (visit here https://github.com/chriskacerguis/codeigniter-restserver) and have a general question about the use of API KEYS. I am very new to APIs and the concepts.

How do KEYS work? There is a table called KEYS defined as follows:

| Default table schema:
|   CREATE TABLE `keys` (
|       `id` INT(11) NOT NULL AUTO_INCREMENT,
|       `user_id` INT(11) NOT NULL,
|       `key` VARCHAR(40) NOT NULL,
|       `level` INT(2) NOT NULL,
|       `ignore_limits` TINYINT(1) NOT NULL DEFAULT '0',
|       `is_private_key` TINYINT(1)  NOT NULL DEFAULT '0',
|       `ip_addresses` TEXT NULL DEFAULT NULL,
|       `date_created` INT(11) NOT NULL,
|       PRIMARY KEY (`id`)
|   ) ENGINE=InnoDB DEFAULT CHARSET=utf8;

There are methods in a class called KEYS as follows:

index_put() // key created.  builds a new key.
index_delete() // Remove a key from the database to stop it working.
level_post() // Update Key. Change the level.
suspend_post() // Update Key.  Change the level.
regenerate_post() //   Regenerate key.  Remove a key from the database to stop it working.

As this package is not well documented and I am new to API, how does above work? For example, do I generate 1 key and insert it to the db permanently. Why is there a delete methods?

From my readings, it sounds like I generate an initial X-API-KEY for the app and then when the client uses a resource I would swap the X-API-KEY for another key using the KEYS class. I would delete it, too, but when? ... or am I all screwed up in my understanding?

Answer 1

Lots of good questions here.

"How do KEYS work?"

A RESTful API service can serve a number of different users, so the API key is an individual key to grant access to the REST API. This allows the service administrator to grant or revoke access to different users or modify permissions granted to each user.

"Why is there a delete method?"

This is in place to revoke API access for a specific key. There could be a number of reasons why this would be used. Perhaps the API user violated the terms of service, or if it's a paid service perhaps their subscription has ended or been revoked. It allows the administrator to cancel a user's access to the API service. This should also answer your question of "when?"