Blog

API2 Machine-to-Machine Authentication: API Key Design, HMAC-Signed Requests and Protecting Token Endpoints

A machine-to-machine API key is designed with a recognisable prefix, stored only as a hash, bound to a tenant and scopes, rotated with two active keys and revocable, and it never travels in the query string. We build a custom authentication handler, HMAC-signed requests with a timestamp and body hash, replay protection, and per-IP and per-account limits on endpoints such as password reset, all with tests.