| When it comes to security please do not try to hack together your own thing it rarely ends up well. People still think OAuth is complicated. OAuth 1 was very complicated and caused untold issues for implementers who didn't use libraries and for those of us who maintained libraries who to this day tell us that our proven libraries implement things wrong. OAuth 1.0 should not be used for any new applications. OAuth is dead long live OAuth(2). OAuth 2 is essentially ready to be used, but unless you need to deal with token issuance and delegated access you don't even need that. If all you need is an API token over SSL then use the Bearer Token spec is what most people call OAuth 2 and is just a single token in a http header or query string. It is incredibly easy to implement and you don't even need a library. http://tools.ietf.org/html/draft-ietf-oauth-v2-bearer-16 More complex but if for some reason you don't want to use SSL or if you need to share url's similar to Amazons signed urls where you need to give some access to a resource such as an image or download use the Mac token, which is receiving serious security analysis now: http://tools.ietf.org/html/draft-hammer-oauth-v2-mac-token-0... Both of them are still officially drafts, but are mainly receiving wording changes now. I'd say they are both ready for primetime. |