# Exposing an API over HTTPS

**URL:** <https://www.ruby-forum.com/t/exposing-an-api-over-https/164210>\
**Category:** Ruby\
**Created:** [March 30, 2009, 1:39am UTC](https://www.ruby-forum.com/t/exposing-an-api-over-https/164210 "2009-03-30T01:39:50Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![fcruxen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/ecae2f/32.png) [@fcruxen](https://www.ruby-forum.com/u/fcruxen)\
**Post date:** [March 30, 2009, 1:39am UTC](https://www.ruby-forum.com/t/exposing-an-api-over-https/164210/1 "2009-03-30T01:39:50Z")

</div>

Hello there,

I run a website that is written in Rails that uses the standard  
authentication mechanisms, where you provide your user and password and  
that gets challenged against an encrypted value.

Now I am about to expose some of the features via API, and I am thinking  
about running a separate API server that would be a Sinatra app.

However, sending the user id and password over the internet doesn’t seem  
very secure, even though we’ll be using HTTPS on the server.

One way of authentication that I always liked is the way, for instance,  
GitHub handles pushes to their servers. When you give them your public  
SSH RSA key, makes this machine authorized to interact as you with their  
server.

Would it be possible to have something similar for this API, even using  
HTTPS? What kind of approaches to this problem are known patterns on the  
Ruby community? Any guidance, in terms of Gems, Articles and such would  
be nice.

Thanks in advance, this forum/list has _always_ been very insightful.

Best regards,  
– Felipe.

---

<div class="post-metadata">

**Author:** ![fcruxen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/ecae2f/32.png) [@fcruxen](https://www.ruby-forum.com/u/fcruxen)\
**Post date:** [March 30, 2009, 3:18am UTC](https://www.ruby-forum.com/t/exposing-an-api-over-https/164210/2 "2009-03-30T03:18:02Z")

</div>

On Mar 29, 6:39 pm, Felipe C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> One way of authentication that I always liked is the way, for instance,  
> GitHub handles pushes to their servers. When you give them your public  
> SSH RSA key, makes this machine authorized to interact as you with their  
> server.

GitHub uses gitosis, which is a Python application built on top of  
SSH. There is a “git” user and the git commands are run as that user,  
so the shortest path, to mimic gitosis, would involve building on top  
of SSH not HTTPS.

You should read the gitosis code.

> **[tv42 - Overview](https://github.com/tv42/)**
>
> i \<=2 ints. tv42 has 143 repositories available. Follow their code on GitHub.

Alan G. - removed\_email\_address@domain.invalid - [http://blogometer.com](http://blogometer.com)