I'm working on an Drupal7 API, using REST services, and consumer JS library (no server code). I'm not trying to authenticate/authorize the end-users, only to identify and allow access to the 'application' using an API KEY.

The goal is to have the 'developers' create an account, request an API KEY, register domains for this api key, and use this key to 'identify' their application to the Drupal7 API. This is pretty much the same API-KEY model that Google Maps is using in v2.

I've looked into OAUTH 2legged approach, which would have been great if my client library was running on the server side, so the secret key wouldn't be exposed, but in our case, the library is JS only (client side), and it doesn't seem a good idea to expose the secret key.

Am i missing something about OAUTH that will allow this? Any pointers will be welcome.


1 Answer 1


The solution came from Kyle Browning (thanks!) - the current dev version of services 7.x-3.x-dev has support for the following OAuth authentications methods:

  • None, OAuth authentication will be disabled by default
  • Unsigned with consumer key
  • Consumer Key, also known as 2-legged OAuth
  • Consumer key and access token, also known as 3-legged OAuth

With this version I ended up using the consumer key for the client libraries as identification token for applications.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.