User registration in REST API

Question

I have a PHP web application that I want to make available to multiple clients. So I'm trying to make it look more like an API. My question is: how can I handle creating new users using the API? If I have a URL like http://example.com/user/signup that accepts new user data and creates a new user through a POST request, is it not a problem that people can abuse it and easily create fake users?

Answer 1

I would recommend only allowing an open identifier in the API, as it would be difficult to implement bot prevention schemes in it (captcha ...)

In any case, even an open id isint, which is a great idea in the API. Are you sure you need registration accessible through the API?

Answer 2

What you need to do is use something like OAuth to authenticate access to your system from registered "applications". Customers can then register for access and receive a token key and secret. They can then use these things to create an access token request. Both parties sign a token using a secret, and then can use an encrypted access token to access the API. Your server checks the incoming token using a secret that only you and authorized clients can have. Now it is safe.