0

I'M beginner to REST API creation. I have created a REST API (provides JSON output) which I give access to multiple users(each has their API key).

I want each user can only use the API on a specific website, not for other websites.

Example:

User-A (with unique API key) took my API for "example1.com".

User-B (with unique API key) took my API for "example2.com".

so my API should run on these 2 sites, they can not run it in "example3.com".

How can I restrict them?

Community
  • 1
  • 1
Lokanath
  • 31
  • 2
  • You can restrict the access via IP. – Andrei Nov 10 '17 at 10:13
  • If you restrict access via IP, can happen that same IP is shared among different websites. Maybe this could be useful for your needs: https://stackoverflow.com/questions/9140504/restricting-access-to-rest-api – fromthestone Nov 10 '17 at 10:17
  • Thanks Andrew for the answer. but how can I get IP of the website from where the CURL is being called..? I am trying with $_SERVER['REMOTE_ADDR']; this one which is not solving my problem.. – Lokanath Nov 10 '17 at 10:17

1 Answers1

0

For what u want to accomplish take a look at CORS (Cross Origin Resource Sharing) Here another post on it

Basically in server side (PHP) 

header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Headers: X-Requested-With, content-type, access-control-allow-origin, access-control-allow-methods, access-control-allow-headers');

In Your case u can do something like:

$http_origin = $_SERVER['HTTP_ORIGIN'];
if ($http_origin == "http://www.domain1.com" || $http_origin == "http://www.domain2.com" || $http_origin == "http://www.domain3.info")
{  
   header("Access-Control-Allow-Origin: $http_origin");
}

For more resources take a look at this post

DISCLAIMER FROM CODE PART: https://stackoverflow.com/a/7454204/1027877

Marcel Djaman
  • 1,276
  • 1
  • 17
  • 34
  • HTTP_ORIGIN dont work for me... throughing error.A PHP Error was encountered Severity: Notice Message: Undefined index: HTTP_ORIGIN – Lokanath Nov 10 '17 at 13:32
  • Even I tried with http_referer but dont work, the API users send data using CURL.. – Lokanath Nov 10 '17 at 13:33