API认证方式

认证方式对比

JWT 结构

# JWT = base64(header).base64(payload).signature

# Header
{ "alg": "HS256", "typ": "JWT" }

# Payload (claims)
{
  "sub": "user_123",
  "iss": "api.example.com",
  "iat": 1704067200,
  "exp": 1704153600,    // expiry (24h later)
  "scope": "read:users write:profile"
}

# Usage in HTTP
Authorization: Bearer eyJhbGciOiJIUzI1NiJ9...

OAuth2 授权类型

# Authorization Code (web apps — most common)
1. Redirect user to /oauth/authorize?client_id=&response_type=code
2. User logs in, gets code
3. Exchange code for access_token (server-side)

# Client Credentials (server-to-server)
POST /oauth/token
grant_type=client_credentials
&client_id=xxx&client_secret=yyy
&scope=read:data

# PKCE (mobile/SPA — no secret exposed)
Use code_verifier + code_challenge for security

API Key最佳实践

• ☐ 使用加密随机数生成密钥（≥32字节）
• ☐ 服务器端只存储哈希版本（bcrypt/SHA-256）
• ☐ 用服务标识作前缀（sk_prod_xxx）
• ☐ 始终通过Authorization头发送，不放URL参数
• ☐ 支持密钥轮换无停机