EVE Technology Lab

I would like to see a feature added to the API, where a player could obtain a public API token, that is unique and tied to a specific website address, that the player could provide to other players to add to their API Key generation, which would generate a unique key for a given website, so that the website that accepts that API key, will know that it was validated ONLY for that specific website.

For instance.

My API enabled website, a forum in this case, for example, http://forum.mycorpforum.com/index.php (not a real website) provides proprietary marketing information that I only want members of my corporation to have access to (with the understanding that after registration all bets are off). Knowing that several of my corporation members have put their API keys out there for various other sites (EVEMon, et.al.), I want to ensure that the key is unique for my site.

So I go to the API support site and register my forum's home page, obtaining a public globally unique ID (GUID) that I provide to my corp members.

They, in turn, go to API support site, and create an API key, providing that GUID to the form, and the new ID/Key combination that is generated will provide not only the access mask, but will validate the GUID associated with it by passing the GUID in as a third parameter to the API call.

If the corp member (or anyone else) tries to use a key that doesn't have that GUID associated with it, or has a different one that has been farmed from somewhere like EVEMon, my application will know that the key is invalid for my website and will deny access, and the API server will log the invalid request

This will HELP with meta-gaming spoofing. It will not 100% prevent it, but it will make it less easy.

Thanks!

While this is not exactly what you want, the vCode is just a generated string. You can force your user to replace for example 9 sequential letters in the string with 'mywebsite' and then only accept vCodes into your application with that string inside.

That way you make sure that it is not possible to steal API keys from for example Evemon or any other place and use them as your own to gain intel and such. It is a way to make sure the API key was specifically generated for your application, since it requires the users to edit the vCode when making it.

I hear where you're coming from, application-specific APIs would be nice.

I use a different method of authenticating users on my site; generate a random 10 digit code, tie it to there login, and then require them to donate 1 ISK to a specified account, and poll your journal for that reason and from that user.

Social engineering aside, it's fairly solid.