clientid overview.html

---

title: Client Id Overview owner: API

<%= modified_date %>

Client Id Overview

Client Id provides a simple authentication mechanism for application. Each registered developer has their own clientId which can be used for APIs supporting this kind of authentication.

NoteMore advanced authentication mechanism is Oauth. See more: **[OAuth Overview](./oauth-overview.html)**

Note: Client Id has many different synonymous: 'API keys', 'apiKey', 'app keys', and 'consumer keys'.

Use Case

It is used when the identity of the end user is not important. In this sense, it is similar to using ApiKey/client_id only. A possible use case is employing client credentials with a scope that allows only public information to be read, while using other methods to enable more powerful scopes.

Benefit

For the developer is that the easiest way to access an API, since there is no token involved. So it's basically fire and forget.

Disadvantages

There are no scopes as we have for oauth2 OAuth Scopes , so the client_id has permissions to do everything, violating the principle of least privilege. The client_id has to be written somewhere in the App source code, so it's only secure for server-to-server communication (should not be used in a mobile/installed/browser app).

Using ApiKey / client_id

The Developer provides his Client Id in his api call. The secures way is to have the client Id in the header. But sometimes, it has to be a query parameter in the URL. That is necessary, when you are doing a redirection, since during a redirection, the header parameters are not forwarded (but it's less secure). The header fieldname or the query string fieldname has to be client_id.

ApiKey are only used, when we don't need to know the End User. E.g. tokenvalidation where we send a sms with a token to the end user phones to verify, if he has the phone. Or for B2B, partners or internal usage, where we have a special relationship and grant them access for all of our customers.

For each registered developer on the Swisscom Developer Portal a clientId and secretId are generated. Client Id can be used directly as a authentication mechanism for APIs supporting this kind of authentication.

Client Id is the simplest form of app-based security that can be configured for an API.

curl -ik -H "Content-Type: application/json" -H "Accept: application/json" -X POST "https://api.swisscom.com/messaging/v1/sms" -d "{\"to\": \"%MOBILE_NUMBER_TO%_\", \"text\": \"%SMS_MESSAGE%_" }" -H "client_id:%CLIENT_ID%"