Which authentication to use for a REST client with Magento 2.1?

Question

I am due to develop a REST client (C#) which will be used for updating stock/customers/products etc. for a Magento 2.1 instance on a remote server.

I think that I should use Token based authentication for my client - namely, obtain a token based on uesrname/password and then send this token with each and every subsequent request. See here for my motivation in using a token.

However, on reviewing nickvane's answer (for Magento 1.x) it seems that OAuth authentication was used. This review has caused me to reconsider my initial choice of Token based authentication for Magento 2.1.

I already have some C# client code that uses token based authentication and it seems to be working well. I have tried for about 1-2 days to get OAuth authentication working but I haven't yet succeeded.

Could somebody who has more experience in this field please advise me if I am on the right track by using token based authentication for my client?

Answer 1

We wrestled with the same problem. In the end we went with token, and have been operating with it for six months now without regret. We just needed a secure means to hook up to the API, and did not need any of the other features of OAuth. I have also had difficulties with OAuth's complexity in the past, and coding for token was dead simple, and seems secure enough. The only confusion was about the lifetime of the issued token. Don't hardcode the token as if it is immortal, but don't regenerate a new one with every call either. The rule is "tokens last forever until they don't -- then call out for a new one".