Is there a way to detect from which source an API is being called?

Question

Is there any method to identify from which source an API is called? source refer to IOS application, web application like a page or button click( Ajax calls etc).

Although, saving a flag like (?source=ios or ?source=webapp) while calling api can be done but i just wanted to know is there any other better option to accomplish this?

I also feel this requirement is weird, because in general an App or a web application is used by n number of users so it is difficult to monitor those many API calls.

please give your valuable suggestions.

Answer 1

There is no perfect way to solve this. Designating a special flag won't solve your problem, because the consumer can put in whatever she wants and you cannot be sure if it is legit or not. The same holds true if you issue different API keys for different consumers - you never know if they decide to switch them up.

The only option that comes to my mind is to analyze the HTTP header and see what you can deduce from it. As you probably know a typical HTTP header looks something like this:

You can try and see how the requests from all sources differ in your case and decide if you can reliably differentiate between them. If you have the luxury of developing the client (i.e. this is not a public API), you can set your custom User-Agent strings for different sources.

But keep in mind that Referrer is not mandatory and thus it is not very reliable, and the user agent can also be spoofed. So it is a solution that is better than nothing, but it's not 100% reliable.

Hope this helps, also here is a similar question. Good luck!