# Private API in REST

**URL:** <https://www.ruby-forum.com/t/private-api-in-rest/119256>\
**Category:** Rails\
**Created:** [November 5, 2007, 1:50pm UTC](https://www.ruby-forum.com/t/private-api-in-rest/119256 "2007-11-05T13:50:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mr\_brownstone](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/59ef9b/32.png) [@mr\_brownstone](https://www.ruby-forum.com/u/mr_brownstone)\
**Post date:** [November 5, 2007, 1:50pm UTC](https://www.ruby-forum.com/t/private-api-in-rest/119256/1 "2007-11-05T13:50:08Z")

</div>

In a app RESTful, all api’s are public. How to leave a private API?

---

<div class="post-metadata">

**Author:** ![mr\_brownstone](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/59ef9b/32.png) [@mr\_brownstone](https://www.ruby-forum.com/u/mr_brownstone)\
**Post date:** [November 5, 2007, 2:11pm UTC](https://www.ruby-forum.com/t/private-api-in-rest/119256/2 "2007-11-05T14:11:37Z")

</div>

Validation throw username and password is a good idea, or maybe restrict  
by  
a source-request-ip that should be in the yaml config file?

2007/11/5, Marcelo J. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):

---

<div class="post-metadata">

**Author:** ![mr\_brownstone](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/59ef9b/32.png) [@mr\_brownstone](https://www.ruby-forum.com/u/mr_brownstone)\
**Post date:** [November 5, 2007, 5:25pm UTC](https://www.ruby-forum.com/t/private-api-in-rest/119256/3 "2007-11-05T17:25:19Z")

</div>

On Nov 5, 2007 7:50 AM, Marcelo J.  
[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> In a app RESTful, all api’s are public.

No they aren’t.

> How to leave a private API?

Authentication. Either use HTTP AUTH or an API key mechanism.

Pat

---

<div class="post-metadata">

**Author:** ![mr\_brownstone](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/59ef9b/32.png) [@mr\_brownstone](https://www.ruby-forum.com/u/mr_brownstone)\
**Post date:** [November 5, 2007, 7:52pm UTC](https://www.ruby-forum.com/t/private-api-in-rest/119256/4 "2007-11-05T19:52:26Z")

</div>

I’m trying to implement an authenticated API as well (similar to  
Highrise and other 37signals apps). We use restful\_authenticated and  
wanted to make something that hooks into the standard username/  
password system we have. HTTP AUTH seems to be the best option, but  
will something like OAuth work better? Or is OAuth something you add  
on top of HTTP AUTH for a REST API? If anyone has done this…