OAuth design for API without users permission

Question

I am developing an API that will be used by users of my customers. Here is what the flow will look like:

1. User of my cloud based service creates an API key.
2. User embeds the API key into their own custom applications.
3. User deploys the application to their own end users.
4. The application talks to our API.

I am looking for advice on how to secure this API. I see a few issues:

1. API key has to be embedded into the users application and is therefore vulnerable to being stolen and abused.
2. Once an API key is compromised, it can easily be disabled, but how will my users update their applications to use a new API key short of having to rebuild the application and redeploy.

Does anyone have any ideas on how to design this?

Answer 1

I may be mistaken but maybe you could have your customers' users talk to your customers' APIs instead. Basically, your customers would keep their secret key on their servers, and not embed them in the clients they give their users, so it couldn't be hijecked (unless their server was compromised of course). Then the users would talk to your API through your customers' APIs.

It would be slower and need more work on the part of your customers, but also safer.