How to handle API authentication in Python

The key to handling API authentication is to understand and use the authentication method correctly. 1. API Key is the simplest authentication method, usually placed in the request header or URL parameters; 2. Basic Auth uses username and password for Base64 encoding transmission, suitable for internal systems; 3. OAuth2 needs to obtain the token first through client_id and client_secret, and then bring a Bearer Token in the request header; 4. In order to deal with the token expiration, the token management class can be encapsulated and automatically refreshed the token; in short, selecting the appropriate method according to the document and safely storing the key information is the key.

Handling API authentication is not actually mysterious. The key is to understand the authentication method you use and how to use it correctly in Python. The authentication mechanisms used by different APIs may be different, but the most common methods are: API Key, Basic Auth, OAuth1, and OAuth2. Let’s take a look at how these common methods are handled in Python.

Use API Key to authenticate

Many services verify the request source through a simple API Key, which is usually sent as part of the request headers.

The method is very simple:

• Add Authorization field to the request header, the value is API_KEY
• Or append key=your_api_key to the URL parameter

 import requests

headers = {
    'Authorization': 'your_api_key_here'
}

response = requests.get('https://api.example.com/data', headers=headers)

Some APIs require you to use specific field names in the header, such as X-API-Key . At this time, you cannot force Authorization , you have to see the documentation instructions.

Using Basic Auth

Basic Auth is a relatively basic HTTP authentication method. Usually, the user name and password are combined into a string and then Base64 encoding is passed to the server.

Python's requests library provides built-in support:

 import requests

response = requests.get(
    'https://api.example.com/data',
    auth=('username', 'password')
)

This method is suitable for testing or internal system use and is not recommended for public services because credentials are easily intercepted.

Use OAuth2 to get the token and call the API

Now many services use the OAuth2 process to obtain the access token (Token), and then use this token to initiate subsequent requests.

The general process is as follows:

• Apply for token from the authentication server (client_id and client_secret are required)
• Received the returned access_token
• Take Authorization: Bearer your_token

 import requests

# Get Token
data = {
    'grant_type': 'client_credentials'
}
auth = ('client_id', 'client_secret')

response = requests.post('https://api.example.com/oauth/token', data=data, auth=auth)
token = response.json()['access_token']

# Use Token to request data headers = {'Authorization': f'Bearer {token}'}
data_response = requests.get('https://api.example.com/data', headers=headers)

The implementation details of OAuth2 on different platforms may vary slightly, such as some need to add scope, and some need to specify content-type. Remember to refer to the official documentation.

Handle Token Expiration and Automatic Refresh

Tokens generally have validity periods, and they need to be re-acquisitioned after they expire. If you are writing long-term service (such as background tasks), it is recommended to encapsulate a Token management class.

You can design the logic like this:

• Get the token before the first request
• Save the token and expiration time
• Determine whether the token expires before each request
• If it expires, re-acquire

 import time

class TokenManager:
    def __init__(self, client_id, client_secret):
        self.client_id = client_id
        self.client_secret = client_secret
        self.token = None
        self.expires_at = 0

    def get_token(self):
        if time.time() >= self.expires_at:
            # Simulate requests for new tokens
            self.token = 'new_token'
            self.expires_at = time.time() 3600 # Assume that one hour expires return self.token

After encapsulation, get_token() method can be called uniformly when actually calling the API to avoid frequent manual refresh.

Basically that's it. Although there are a lot of authentication methods, each has a fixed routine. The key is to choose the right method based on the document and pay attention to safely storing the key information.

The above is the detailed content of How to handle API authentication in Python. For more information, please follow other related articles on the PHP Chinese website!