title: Securing a RESTful API
body: <p>For my current side project, which is a modular web management system (which could contain modules for database management, cms, project management, resource management, time tracking, etc…), I want to expose the entire system as a RESTful API as I think that will make the system as more usable.  The system itself is going to be coded in ASP.MET MVC3 however if I make all the data/actions available through a RESTful API, that should make the system very easy to use with PHP, Ruby, Python, etc… (they could even make there own interface to manage certain data if they wanted).</p>
  
  <p>However, the one thing that seems hard to do easily (from the user's using the RESTful API point of view) with a RESTful API is security with ajax functionality.  If I wanted something that was complex to setup and use, I would just create SOAP services but the whole drive for using a RESTful API is that it is very easy.  The most common way of securing a RESTful API with with a key that is associated with a user.  This works fine when all the calls are done on the server side however once you start doing ajax functionality, that changes.  I would want the RESTful API to be able to be called directly from javascript however anyone who are firebug would easily be able to access the key the user is using allow that person access to the system.  Is there a better way the secure a RESTful API where it does not make the user of the RESTful API do complex things just to set it up?</p>