API Keys and Token Authentication

# CHAPTER 14

API Keys and Token Authentication #

1. Introduction #

2. Learning Objectives #

• Design a MySQL database schema to store API tokens.

• Generate secure, random API keys using PHP.

• Implement an authentication middleware/check in your PHP script.

• Understand the difference between Application API Keys and User Access Tokens.

• Authenticate requests by validating tokens against the database.

3. Beginner-Friendly Explanation #

• API Key: Think of this as a VIP pass given to a specific *company* or *app*. For example, when your server talks to Stripe to process payments, it uses an API Key. It represents the app, not a specific human.

• User Token: Think of this as a hotel room key given to a specific *human*. When you log into the mobile app, you get a token. It represents *you*.

Both work the exact same way technically: they are long, random strings of text checked against a database.

4. Real-World Examples #

• API Key: Google Maps API. You generate an API key in the Google Console and hardcode it into your website so your site is allowed to load the map.

• User Token: GitHub Personal Access Tokens. You generate a token on GitHub and use it in your terminal to push code, acting on behalf of your user account.

5. Detailed Code Examples #

1. Database Schema (users table):

CREATE TABLE users (
    id INT AUTO_INCREMENT PRIMARY KEY,
    username VARCHAR(50),
    password_hash VARCHAR(255),
    api_token VARCHAR(100) UNIQUE NULL
);

2. Generating a Token on Login (login.php):

<?php
// ... assume we checked $_POST['username'] and password_verify() succeeded ...

// Generate a secure 64-character random string
$newToken = bin2hex(random_bytes(32));

// Save it to the database for this user
$stmt = $pdo->prepare("UPDATE users SET api_token = :token WHERE id = :id");
$stmt->execute([&#039;:token' => $newToken, ':id' => $user['id']]);

// Return the token to the client
echo json_encode([
    "message" => "Login successful",
    "token" => $newToken
]);
?>

3. Validating the Token on a Protected Route (profile.php):

<?php
$headers = getallheaders();
$authHeader = $headers[&#039;Authorization'] ?? '';

// Extract the token from "Bearer xyz123..."
if (preg_match(&#039;/Bearer\s(\S+)/', $authHeader, $matches)) {
    $clientToken = $matches[1];

    // Check database
    $stmt = $pdo->prepare("SELECT id, username FROM users WHERE api_token = :token");
    $stmt->execute([&#039;:token' => $clientToken]);
    $user = $stmt->fetch(PDO::FETCH_ASSOC);

    if ($user) {
        // Success! We know exactly who this is.
        echo json_encode(["message" => "Welcome, " . $user[&#039;username']]);
    } else {
        // Token provided, but not found in DB
        http_response_code(401);
        echo json_encode(["error" => "Invalid Token"]);
    }
} else {
    // No token provided at all
    http_response_code(401);
    echo json_encode(["error" => "Authorization header missing or malformed"]);
}
?>

6. Request/Response Examples #

GET /profile.php HTTP/1.1
Host: api.myapp.com
Authorization: Bearer 8f7d9a8c7b6...

Successful Response:

{
  "message": "Welcome, admin"
}

7. HTTP Examples #

GET /data HTTP/1.1
X-API-Key: my_super_secret_app_key_99

*Note: While common for server-to-server APIs, Bearer tokens are preferred for user authentication.*

8. JSON Examples #

{
  "success": true,
  "message": "Successfully logged out. Token revoked."
}

9. Best Practices #

• Use randombytes(): Never use rand(), mtrand(), or md5(time()) to generate tokens. They are predictable and easily hacked. Always use a cryptographically secure function like randombytes().

• Database Indexing: Ensure your apitoken column in MySQL has a UNIQUE INDEX. Since every single API request requires a WHERE apitoken = ? lookup, an index will make this query lightning fast.

1. 1. What PHP function is used to convert binary data (from randombytes) into a readable hexadecimal string?

12. Coding Challenges #

13. MCQs with Answers #

14. Interview Questions #

• Q: Walk me through the database flow of a token-based login system, from the /login request to a subsequent protected /profile request.

• Q: What is the difference between an API Key and a User Bearer Token?

• Q: How do you securely handle "Log Out" in a stateless API?

15. FAQs #

16. Summary #

17. Next Chapter Recommendation #