创建安全的API通信

Question

I am looking to build an API that I can deploy on my servers to monitor system load.
It will report to a central manager server that runs a client to display the information.

The issue I am struggling with is best to secure the API.
What I want is for the client to be the only software that can access the server and retrieve this information but I am unsure how to achieve this using PHP.
I also want the possibility of distributing the API and client for others to use on their servers so I don't want people to be able to access other people data if they are using the API also.

The client is also written in PHP using MySql and has a secure login.

Answer 1

This sounds like you're trying to solve the wrong problem.

I also want the possibility of distributing the API and client for others to use on their servers so I don't want people to be able to access other people data if they are using the API also.

The only right answer to this is authentication. You need to protect your API by giving each user access credentials known only to them.

Your API must never reveal any data that the client isn't allowed to see as per their authentication credentials. Trying to work around this danger by trying to somehow protect the client from prying eyes is not safe - somebody who has access to the client and can observe it running will be able to reverse engineer any traffic between it and the server given enough effort.

If the API is properly secured, it won't matter to you which client tool is used to access it. The requirement to limit API access to a certain program will go away.