Maybe this is stupid, but lets take a look at the following scenario: I created an API in Wolfram Cloud and deployed it with private permissions. However, I can't access it from the autogenerated code for it, since it returns 401 unauthorized. How does a private API accept credentials?

The other thing I can do is to deploy it public and protect it by myself, by asking for a certain key, synchronized between the client and the API. But if I do that, someone can send a lot of requests that will return 401, but they will count to my allowed requests per month.

How do I authenticate in a private API?

  • $\begingroup$ I believe the authentication is handled by logging into your Wolfram user account using your web browser. When I try to access a private CloudDeploy URL, it automatically directs me to login. $\endgroup$ – Rashid Jun 12 '16 at 0:57
  • $\begingroup$ Could you post a minimal example of the code you are trying? $\endgroup$ – Rashid Jun 12 '16 at 0:57
  • $\begingroup$ I want to deploy a private API, and access it from another language. There should be a way to pass my credentials, but I am not sure how. Or maybe there is an endpoint on which I should make a POST and get a token? For example, CloudConnect[] is a function that I need to do from another language. $\endgroup$ – Hristo Vrigazov Jun 12 '16 at 12:35

You may want to implement the PermissionsKey option in the API deployment permissions:

obj = CloudDeploy[APIFunction[{"n" -> Integer}, #n^2 &], 
Permissions -> {PermissionsKey["thekey"] -> "Execute"}]

Then you can make a request with _key=thekey in the query string.

For a more fine-grained access you may want to implement something like JWT tokens as documented elsewhere and make use of authenticator aggregator service to ease things for example.

Also note that Wolfram Cloud does not seem to provide any DDoS protection service as you mentioned and you should seek for a separate firewalling solution elsewhere - and having one separately is quite normal (read: a must) for any web application. And as the cloud APIs are just HTTP - you can utilise almost any industrial protection solution available.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.