Menu
Hi I have an rails application & I want to build an API for the same.I have never worked on API building so far. So please tell me from where should I start to build an API. I want to make it public so that developers can build application using my API. I have two questions in my mind
I tried to run demo at here but only part is working but I am unable to run client part.
Please guide me in detail to learn this stuff. Thanks in advance...!
347
Client key is used to generate credit card tokens specifically for Core API implementation, while server key is used for the remainder of API calls on server-side. You can see you access keys in your Merchant Administration Portal (MAP) at Settings > Access Keys.
In cryptography, a client certificate is a type of digital certificate that is used by client systems to make authenticated requests to a remote server. Client certificates play a key role in many mutual authentication designs, providing strong assurances of a requester's identity.
The private key of the client certificate is only needed during the SSL handshake to prove that the client owns the certificate. This proof is done by the client creating a signature over previous handshake messages using its private key and sending this signature inside the CertificateVerify message.
It's been a while since this question was asked, and there are many great resources that have been created since, which I'll summarise and link to below.
The Doorkeeper gem allows you to implement OAuth provider functionality, and is well documented and well maintained. It integrates well with Devise, and there are example applications to learn from.
On the client side of things (for testing the integration, or if you want to provide a Ruby client for external developers), you can use OmniAuth, and the Doorkeeper docs take you through the process of creating a custom strategy.
Depending on what sort of API you're building, you may find that OAuth is overkill. OAuth is useful in cases where you are a content provider, and the developer is a third party that wants to access information on behalf of a user, but without needing knowledge of their password.
If your use case is more simple (e.g. you can provide a secret token and key directly to the API user), then generating and checking access tokens may be enough. In this case, you generate a key (using SecureRandom.urlsafe_base64, or has_secure_token if you're on Rails 5) and store it. The API user provides this token on each request in order to authenticate, and you can regenerate the token if the original is ever compromised.
More detailed info on that here and here.
108
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
