Third-party API Authentication Using Digest Credentials

The credential field shown in the request contains the digest credential, using the format key:<hash>=version:v1, where the hash is the hexadecimal SHA-256 digest of the client_id. The version component indicates the authentication scheme version, allowing the server to select the appropriate verification algorithm.

Workflow overview:

• Registration: Each third-party system receives a unique client_id from the service platform, which stores the system's identity and its authorized API endpoints.
• Request: When calling a protected API, the third party includes the credential field computed according to the specified algorithm.
• Verification: The server reads the version from the credential, applies the corresponding algorithm (SHA-256 for v1), and checks whether the provided hash matches a registered client_id.
• Authorization: If identity verification succeeds, the server checks whether the caller's permissions grant access to the requested endpoint. Both checks must pass for the request to proceed.

This design is lightweight: confirming identity requires a single hash computation and comparison. The platform can add new third parties and modify their permissions directly in the database without deploying new code.

{
    "credential": "key:46d47e6c6d8e0c826e214447f80627b6e527c0bfa52323332adb6479c639b5ee=version:v1",
    "page_size": 10,
    "page": 1
}

Credential Generation

import hashlib

client_id = "alpha_secret"  # 示例客户端密钥
digest = hashlib.sha256(client_id.encode('utf-8')).hexdigest()
credential = f"key:{digest}=version:v1"

print(credential)

Server-side Authentication and Authorization

import hashlib

clients_db = {
    "alpha_system": {
        "secret": "alpha_secret",
        "permissions": ["service:getUserContact", "data:listRecords"]
    }
}

def check_credential(credential_str, required_permission):
    try:
        hash_part, version_part = credential_str.split('=', 1)
        version = version_part.split(':', 1)[1]
        provided_hash = hash_part.split(':', 1)[1]
    except Exception:
        return False, "格式错误"

    if version != "v1":
        return False, "版本不支持"

    for name, info in clients_db.items():
        expected_hash = hashlib.sha256(info["secret"].encode()).hexdigest()
        if expected_hash == provided_hash:
            if required_permission in info["permissions"]:
                return True, f"授权成功:{name}"
            return False, "无权限"
    return False, "身份无效"

Security Analysis

Strengths:

• Hash functions are one-way; the client identity remains hidden.
• Simple to implement with low performance overhead.
• Version numbering allows future algorithm updates.

Risks:

• Vulnerable to replay attacks.
• Provides no verification of request integrity.
• Weak or leaked client credentials pose immediate risks.

Future Improvements

• Add timestamps or nonce values to prevent replays.
• Use HMAC or digital signatures to protect critical request fields.
• Introduce RBAC or ABAC for more granular permission control.
• Separate the public client_id from the private secret.
• Rotate secrets periodically and enforce TLS throughout.

Summary

This digest credential scheme satisfies basic authentication and authorization with minimal overhead, suitable for scenarios where performance matters, integration costs are constrained, and the threat environment is relatively controlled. When higher security is required, introduce timestamps, HMAC, signatures, or fine-grained permission models as needed.