Request for comment: API keys

[codycooperross]

As part of ongoing development in authentication and credentialing, DataCite is planning an implementation of API keys for DataCite APIs, like the REST and MDS APIs, to improve security and usability.

API keys will act as an alternative to sharing repository credentials for API authentication. The current Basic authentication workflow will continue to be supported, and API keys are being designed as a drop-in replacement.

Planned features include:

• Authenticate API requests, like DOI creation and updates, without having to share repository account credentials.
• Create multiple API keys for the same repository account and revoke them as needed.

We welcome community feedback on these improvements to API authentication as we continue development. What features might you need to implement API keys in your DataCite integration? Respond to this post or send us an email at support@datacite.org with your thoughts and suggestions. We will keep this discussion updated as we proceed.

[danlamanna]

Thanks for putting this up; I'm a consumer that would love to see this feature implemented. The only additional features I can think of that would be useful is the ability to scope API keys by either read/write access, or by access to specific prefixes e.g. this key can only interact/create/delete DOIs under prefix 10.12345.

[codycooperross]

That's great to hear, @danlamanna ! Thank you for outlining these additional features as well. Can I ask what scenarios might you use a read-only API key?

[danlamanna]

Sorry for the long delay. One of the things we do in one of our apps is fetch schema.org JSON-LD and formatted citations, both via the Accept header of the GET /dois/{doi} endpoint. It would be nice if this app couldn't mint new DOIs (or delete drafts, etc) - but that's really just a nice to have.

To tack on one other thing, it would be very useful for the UI to indicate when each API key was last used - omitting this is a personal pet peeve of mine 😅.

[codycooperross]

@danlamanna , as you'll see below, we recently released the API key feature described in this request for comment! While we don't support scoped keys yet, we've logged this feedback for future iterations on the feature.

The API responses for API keys do indicate when the key was last used, which you can learn more about in our Support documentation.

Thanks again for your feedback as we developed this feature!

[codycooperross]

We recently released the API key feature described above! Learn about DataCite API keys in our latest release notes and explore how to use them with DataCite APIs in our Support documentation.

We welcome future API key feedback in the linked release notes post. Thank you to all who contributed their thoughts and suggestions!