• caglararli@hotmail.com
  • 05386281520

Is OAuth more secure compared to API Keys

Çağlar Arlı      -    64 Views

Is OAuth more secure compared to API Keys

I have worked on many API integrations scenarios and I used 2 approaches to authenticate the API calls:

  1. Using API Keys

    For example inside Hubspot integration I use this web call to get all the accounts using API Key:

     https://api.hubapi.com/companies/v2/companies/paged?hapikey=**********&properties=website&properties=mse_scan&properties=phone&limit=100
    
  2. Using OAuth

    For example inside SharePoint I create an app which generates a ClientID & ClientSecret, then inside my project's web.config I store the clientID & ClientSecret

    <appSettings file="custom.config">
     <add key="ClientId" value="e****7" />
     <add key="ClientSecret" value="**=" />
    </appSettings>
    

In both cases we have confidential info passed/stored, either APIKey or ClientID and ClientSecret. So from a security point of view, is it true that using oAuth isn't more secure than using APIKeys? Because if a malicious actor gets the APIKey then they can access our application but if they get the ClientID and ClientSecret then they can also access it.