In modern web and mobile applications, securing REST APIs is critical. Unauthorized access can lead to data leaks, account takeovers, or service abuse. Two of the most widely used approaches for API security are API keys and JWT (JSON Web Tokens).
This article explores how to implement both methods in ASP.NET Core, highlighting best practices, real-world implementation patterns, and strategies for production-ready security.
Table of Contents
Introduction to API Security
API Keys vs JWT Tokens
Architectural Considerations
Securing APIs with API Keys
Securing APIs with JWT Tokens
Token Expiration and Refresh
Role-Based Access Control (RBAC) with JWT
Best Practices for Production
Logging and Monitoring
Common Pitfalls
Conclusion
1. Introduction to API Security
REST APIs are stateless interfaces, which makes them scalable but also vulnerable if not secured. Common security threats include:
API keys and JWT tokens help mitigate these risks by ensuring only authenticated and authorized clients can access the API.
2. API Keys vs JWT Tokens
| Feature | API Key | JWT Token |
|---|
| Type | Simple static token | Signed JSON object |
| Use Case | Service-to-service authentication | User authentication, authorization |
| Expiration | Usually static | Configurable, often short-lived |
| Revocation | Manual | Can use blacklists or short TTL |
| Security | Less secure alone | More secure, can include claims |
API Keys: Ideal for service-to-service APIs, simple and easy to implement.
JWT Tokens: Ideal for user authentication and authorization, supports claims and expiry.
3. Architectural Considerations
When securing APIs:
Use HTTPS: Never transmit tokens or keys over HTTP.
Separate Authentication and Authorization: Authentication verifies identity; authorization checks permissions.
Use Middleware: ASP.NET Core allows adding middleware for token validation and claims extraction.
Centralized Key Management: Avoid hardcoding keys in code.
4. Securing APIs with API Keys
4.1 Generating API Keys
API keys are usually random strings stored securely in a database. Example:
public string GenerateApiKey()
{
return Convert.ToBase64String(RandomNumberGenerator.GetBytes(32));
}
4.2 Storing API Keys
Store hashed API keys in the database to avoid leaks.
Include metadata like ClientName, CreationDate, ExpiryDate, and Status.
public class ApiKey
{
public string KeyHash { get; set; }
public string ClientName { get; set; }
public DateTime CreatedAt { get; set; }
public DateTime? ExpiresAt { get; set; }
public bool IsActive { get; set; }
}
4.3 Validating API Keys in ASP.NET Core
Create a middleware:
public class ApiKeyMiddleware
{
private readonly RequestDelegate _next;
private const string API_KEY_HEADER = "X-API-KEY";
public ApiKeyMiddleware(RequestDelegate next)
{
_next = next;
}
public async Task InvokeAsync(HttpContext context, IApiKeyService apiKeyService)
{
if (!context.Request.Headers.TryGetValue(API_KEY_HEADER, out var extractedKey))
{
context.Response.StatusCode = 401;
await context.Response.WriteAsync("API Key is missing");
return;
}
if (!await apiKeyService.IsValidKeyAsync(extractedKey))
{
context.Response.StatusCode = 403;
await context.Response.WriteAsync("Invalid API Key");
return;
}
await _next(context);
}
}
Register middleware in Program.cs:
app.UseMiddleware<ApiKeyMiddleware>();
4.4 Best Practices for API Keys
Rotate keys periodically.
Use rate limiting per key.
Restrict IP addresses if possible.
Monitor key usage.
5. Securing APIs with JWT Tokens
JWTs are signed tokens that carry claims about the user or client.
5.1 Installing Packages
dotnet add package Microsoft.AspNetCore.Authentication.JwtBearer
5.2 Configuring JWT Authentication
builder.Services.AddAuthentication(options =>
{
options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddJwtBearer(options =>
{
options.TokenValidationParameters = new TokenValidationParameters
{
ValidateIssuer = true,
ValidateAudience = true,
ValidateLifetime = true,
ValidateIssuerSigningKey = true,
ValidIssuer = builder.Configuration["Jwt:Issuer"],
ValidAudience = builder.Configuration["Jwt:Audience"],
IssuerSigningKey = new SymmetricSecurityKey(
Encoding.UTF8.GetBytes(builder.Configuration["Jwt:Key"]))
};
});
5.3 Generating JWT Tokens
public string GenerateJwtToken(User user)
{
var claims = new[]
{
new Claim(JwtRegisteredClaimNames.Sub, user.UserName),
new Claim("role", user.Role)
};
var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_config["Jwt:Key"]));
var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
var token = new JwtSecurityToken(
issuer: _config["Jwt:Issuer"],
audience: _config["Jwt:Audience"],
claims: claims,
expires: DateTime.UtcNow.AddHours(1),
signingCredentials: creds
);
return new JwtSecurityTokenHandler().WriteToken(token);
}
5.4 Validating JWT Tokens
Use the [Authorize] attribute on controllers:
[Authorize(Roles = "Admin")]
[HttpGet("admin-data")]
public IActionResult GetAdminData()
{
return Ok("Secure admin data");
}
ASP.NET Core middleware handles validation automatically.
6. Token Expiration and Refresh
JWT tokens should have short expiration (15-60 minutes).
Implement refresh tokens for long-lived sessions.
Store refresh tokens securely in the database and revoke on logout or suspicious activity.
7. Role-Based Access Control (RBAC) with JWT
Add roles as claims in JWT.
Use [Authorize(Roles = "Admin,Manager")] for role-based endpoints.
Claims can also include permissions, department, or tenant information.
[Authorize(Policy = "CanEditOrders")]
public IActionResult EditOrder(int id)
{
// Only users with "CanEditOrders" claim can access
return Ok();
}
8. Best Practices for Production
Always use HTTPS to protect tokens and API keys.
Do not store sensitive data in JWT payloads — only claims necessary for authorization.
Rotate keys and secrets regularly.
Limit API access using IP whitelisting and rate limiting.
Blacklist revoked tokens to prevent misuse.
Use standard libraries for token validation instead of custom code.
9. Logging and Monitoring
Log failed authentication attempts.
Monitor token usage patterns.
Integrate with SIEM tools for suspicious activity detection.
10. Common Pitfalls
Using JWT tokens without expiration.
Hardcoding API keys in source code.
Not validating token signatures.
Storing sensitive user data in JWT payloads.
Not implementing proper revocation and rotation strategies.
Conclusion
Securing REST APIs with API keys and JWT tokens is essential for modern applications.
API keys are simple and suitable for service-to-service authentication.
JWT tokens provide flexible, claim-based authentication and authorization for users.
By following best practices, implementing proper token validation, expiration, and monitoring, developers can build APIs that are secure, maintainable, and production-ready.
Key Takeaways for Senior Developers
Prefer JWT for user authentication and claims-based authorization.
Use API keys for server-to-server communication with rate limiting.
Always use HTTPS and rotate secrets periodically.
Validate tokens using standard libraries and never trust client input.
Implement RBAC and claims for fine-grained access control.