脚本中API接口调用如何鉴权

本文目录导读：

1. API Key（最常见、最简单）
2. Bearer Token / JWT
3. Basic Auth
4. OAuth 2.0（复杂但灵活）
5. HMAC 签名（高安全性）
6. 多因素组合
7. 安全最佳实践
8. 不同场景推荐选择

在脚本中调用API接口进行鉴权，通常有以下几种主流方式,选择哪种取决于API提供方的要求：

API Key（最常见、最简单）

请求头方式

import requests
headers = {
    "X-API-Key": "your_api_key_here",
    "Content-Type": "application/json"
}
response = requests.get("https://api.example.com/data", headers=headers)

查询参数方式

response = requests.get("https://api.example.com/data", 
                       params={"api_key": "your_api_key_here"})

Bearer Token / JWT

headers = {
    "Authorization": "Bearer eyJhbGciOiJIUzI1NiIs...",
    "Content-Type": "application/json"
}
response = requests.get("https://api.example.com/protected", headers=headers)

获取token（如果需要先登录）

# 先获取token
auth_response = requests.post("https://api.example.com/auth/login", json={
    "username": "user",
    "password": "pass"
})
token = auth_response.json()["access_token"]
# 使用token
headers = {"Authorization": f"Bearer {token}"}
response = requests.get("https://api.example.com/protected", headers=headers)

Basic Auth

from requests.auth import HTTPBasicAuth
response = requests.get("https://api.example.com/data",
                       auth=HTTPBasicAuth("username", "password"))

OAuth 2.0（复杂但灵活）

客户端凭证模式（Client Credentials）

# 获取token
token_url = "https://auth.example.com/token"
data = {
    "client_id": "your_client_id",
    "client_secret": "your_client_secret",
    "grant_type": "client_credentials"
}
token_response = requests.post(token_url, data=data)
access_token = token_response.json()["access_token"]
# 使用token
headers = {"Authorization": f"Bearer {access_token}"}
response = requests.get("https://api.example.com/api/data", headers=headers)

授权码模式（Authorization Code）

# 1. 获取授权码（通常需要用户在浏览器中授权）
auth_url = f"https://auth.example.com/authorize?response_type=code&client_id=CLIENT_ID&redirect_uri=REDIRECT_URI"
# 2. 用授权码换token
response = requests.post("https://auth.example.com/token", data={
    "code": "authorization_code",
    "client_id": "CLIENT_ID",
    "client_secret": "CLIENT_SECRET",
    "redirect_uri": "REDIRECT_URI",
    "grant_type": "authorization_code"
})
access_token = response.json()["access_token"]

HMAC 签名（高安全性）

import hashlib
import hmac
import time
from urllib.parse import urlencode
def generate_signature(secret_key, method, path, params, timestamp):
    # 按规则拼接字符串
    string_to_sign = f"{method}\n{path}\n{urlencode(sorted(params.items()))}\n{timestamp}"
    # 生成签名
    signature = hmac.new(
        secret_key.encode(),
        string_to_sign.encode(),
        hashlib.sha256
    ).hexdigest()
    return signature
# 使用示例
api_secret = "your_secret_key"
timestamp = str(int(time.time()))
method = "GET"
path = "/api/v1/data"
params = {"user_id": "123"}
signature = generate_signature(api_secret, method, path, params, timestamp)
headers = {
    "X-Timestamp": timestamp,
    "X-Signature": signature,
    "X-API-Key": "your_api_key"
}
response = requests.get(f"https://api.example.com{path}", 
                       params=params, headers=headers)

多因素组合

有些API要求多种鉴权方式组合：

headers = {
    "X-API-Key": "api_key",
    "Authorization": "Bearer token",
    "X-Timestamp": str(int(time.time())),
    "X-Signature": generated_signature
}

安全最佳实践

不要硬编码密钥

# 不好的做法
API_KEY = "abc123"  # 硬编码
# 好的做法（使用环境变量）
import os
API_KEY = os.getenv("API_KEY")

使用配置文件或.env文件

# .env文件
API_KEY=your_api_key_here
API_SECRET=your_secret_here
# Python脚本
from dotenv import load_dotenv
import os
load_dotenv()
api_key = os.getenv("API_KEY")
api_secret = os.getenv("API_SECRET")

实现token刷新机制

class ApiClient:
    def __init__(self, base_url, client_id, client_secret):
        self.base_url = base_url
        self.client_id = client_id
        self.client_secret = client_secret
        self.access_token = None
        self.refresh_token = None
    def get_access_token(self):
        if not self.access_token or self.is_token_expired():
            self.refresh_tokens()
        return self.access_token
    def refresh_tokens(self):
        # 刷新token逻辑
        pass

处理鉴权失败

response = requests.get(url, headers=headers)
if response.status_code == 401:  # Unauthorized
    print("鉴权失败，请检查API密钥")
elif response.status_code == 403:  # Forbidden
    print("权限不足")
elif response.status_code == 200:
    # 处理成功响应
    pass

不同场景推荐选择

选择哪种方式主要看API文档的要求，以及你的安全需求等级。永远不要在代码中明文存储敏感凭证。