API認証
API認証がチームが機密データを保護し、ユーザーとの信頼を築き、会社の評判を守るのにどのように役立つかを学びましょう。
API認証とは何ですか？
API認証は、APIリクエストを送信するユーザーの身元を検証するプロセスであり、APIセキュリティの重要な柱のひとつです。API認証には、HTTP Basic認証、APIキー認証、JWT、OAuthなどさまざまな方式があり、それぞれにメリットやトレードオフ、適したユースケースがあります。しかし、どのAPI認証メカニズムにも共通する目的は、機密データを保護し、APIの不正利用を防ぐことです。
ここでは、API認証の主なメリットや一般的な認証方式を紹介するとともに、API認証とAPI認可の違い、API認証のベストプラクティスについて解説します。また、Postman API Platformが、API提供者とAPI利用者の双方にとって健全なAPI認証の実践をどのように支援するのかについてもご紹介します。
What are the benefits of API authentication?
Today, an increasing number of organizations are focusing on APIs in order to unlock new features and advance business objectives. In fact, many teams have adopted the API-first development model, in which applications are conceptualized and built as a collection of services that are delivered through APIs. With this approach, teams prioritize API quality and security in order to ensure that their APIs remain highly performant and scalable and do not serve as entry points for attackers. API authentication is a primary way in which APIs are secured, and it enables teams to protect sensitive data, build trust with users, and safeguard the company's reputation.
API認証にはどのようなメリットがありますか？
近年、多くの組織が新しい機能を実現し、ビジネス目標を達成するためにAPIへの注力を強めています。実際に、多くのチームがAPIファーストの開発モデルを採用しており、アプリケーションをAPIを通じて提供されるサービスの集合体として設計・構築しています。このアプローチでは、APIのパフォーマンスとスケーラビリティを高い水準で維持し、攻撃者の侵入口にならないようにするため、APIの品質とセキュリティを優先します。API認証はAPIを保護するための主要な手段のひとつであり、機密データの保護、ユーザーとの信頼関係の構築、そして企業の評判の保護に役立ちます。
HTTP basic authentication
HTTP basic authentication is the most rudimentary way to implement API authentication. It involves sending credentials as user/password pairs in an Authorization header field, where the credentials are encoded using Base64. However, these credentials are not hashed or encrypted, which makes this authentication mechanism insecure unless it is used in conjunction with HTTPS.
API key authentication
An API key is a unique identifier that an API provider issues to registered users in order to control usage and monitor access. The API key must be sent with every request—either in the query string, as a request header, or as a cookie. Like HTTP basic authentication, API key authentication must be used with HTTPS to ensure the API key remains secure.
JWT authentication
JWT, which stands for JSON Web Token, is a compact, stateless mechanism for API authentication. When a user logs into an application, the API server creates a digitally signed and encrypted JWT that includes the user's identity. The client then includes the JWT in every subsequent request, which the server deserializes and validates. The user's data is therefore not stored on the server's side, which improves scalability.
OAuth authentication
OAuth is a token-based authentication mechanism that enables a user to grant third-party access to their account without having to share their login credentials. OAuth 2.0, which provides greater flexibility and scalability than OAuth 1.0, has become the gold standard for API authentication, and it supports extensive API integration without putting user data at risk.
最も一般的なAPI認証方式にはどのようなものがあり、どのように機能しますか？
API認証にはさまざまな方式があり、それぞれ異なる仕組みで動作します。以下の4つは、その中でも特によく利用されている認証方式です。
What are some best practices for API authentication?
API authentication is critical to your application's overall security posture, so it's imperative that you adhere to the following best practices as you design and develop your API:
- Use a well-established authentication framework: Authentication is a complex process with high stakes, so it's important to use a well-established framework instead of writing your own authentication code from scratch. Protocols such as OAuth, OpenID Connect, and JWT have been thoroughly tested and are more secure than homegrown solutions.
- Choose an authentication method that is appropriate for your use case: When deciding how to authenticate users, it's important to consider the sensitivity of your data and the overall needs of your application. For example, HTTP basic authentication is easy to implement, but it has significant vulnerabilities and scalability issues that make it ill-suited for most production environments.
- Implement two-factor authentication: Two-factor authentication (2FA) requires a user to provide two forms of authentication, such as a password and a token. This approach adds an extra layer of security and makes it more difficult for attackers to gain access to the API.
- Use HTTPS: Some authentication mechanisms, such as HTTP basic authentication and API key authentication, are not secure because they do not encrypt credentials. It's therefore essential to use HTTPS to prevent eavesdropping and keep sensitive data secure.
- Monitor API access with logs: Even if you're confident in your API's authentication workflow, it's important to monitor logs that record access to your API. This practice will help you detect suspicious activity, such as a spike in failed login attempts or logins from an unusual location.
Learn more with Postman Academy's API authentication and authorization course
How can Postman help with API authentication?
The Postman API Platform comes equipped with many features that support healthy API authentication practices—whether you're producing an API or consuming one. With Postman, you can:
- Leverage a wide range of authentication mechanisms: Postman provides built-in support for several authentication types, including OAuth 2.0, API keys, JWT bearer tokens, and AWS signature. These authentication methods can be defined at the request, collection, or folder level, which facilitates inheritance and improves consistency.
- Receive security warnings about authentication issues: Postman API Governance can automatically warn you of authentication-related issues, such as exposed authentication data or a missing authentication scheme. The warning will also include a suggested fix, so you can resolve the issue quickly.
- Automatically surface exposed authentication tokens: The Postman Secret Scanner scans your public workspaces, collections, and environments for exposed authentication tokens. It includes default support for tokens from over 30 service providers, and it can be customized to look for any other proprietary or third-party app tokens, as well.
- Refresh your OAuth 2.0 access tokens: Postman can automatically refresh OAuth 2.0 access tokens before they expire, which saves the user time by eliminating the need to repeat the entire authorization process.
- Quickly authenticate with public APIs: Postman will guide users through the authentication process for several popular APIs, including OpenAI, Notion, and Twilio. This feature streamlines the authentication process and significantly reduces your time to first call.
- Correlate API audit logs with other security data: Teams can monitor audit logs on a built-in dashboard to ensure that only legitimate users are interacting with their API. Audit logs can also be accessed with the Postman API, which allows teams to analyze these logs alongside security data from third-party SIEM tools.
Get started with Postman
