https://tradingcardapi.com/assets/js/b2c33689.31964d0c.js

1"use strict";(globalThis.webpackChunktradingcardapi_public_docs||=[]).push([[4159],{4214(e,t,i){i.r(t),i.d(t,{default:()=>h,metadata:()=>a});var a=i(570),n=i(4848),r=i(8453),s=i(7451);const o={authorsImageUrls:[void 0]};function l(e){const t={a:"a",h2:"h2",h3:"h3",hr:"hr",li:"li",p:"p",strong:"strong",ul:"ul",...(0,r.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(s.A,{src:"oauth-vs-api-keys.png",alt:"OAuth 2.0 vs API Keys Authentication Methods"}),"\n",(0,n.jsxs)(t.p,{children:["When I first built the ",(0,n.jsx)(t.a,{href:"/docs/getting-started/overview",children:"Trading Card API"}),", I chose OAuth 2.0 with Laravel Passport. It gave us enterprise-grade security and flexibility from day one."]}),"\n",(0,n.jsx)(t.p,{children:"After using the API on my own projects, I've realized that while OAuth is perfect for some use cases, many developers would benefit from the simplicity of API keys for others. Here's why we're adding both options."}),"\n",(0,n.jsx)(t.h2,{id:"the-reality-of-oauth-20-vs-api-keys",children:"The Reality of OAuth 2.0 vs API Keys"}),"\n",(0,n.jsx)(t.h3,{id:"oauth-20",children:"OAuth 2.0"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:"\u2705 Enterprise-ready, secure token management"}),"\n",(0,n.jsx)(t.li,{children:"\u2705 Built-in token expiration and refresh"}),"\n",(0,n.jsx)(t.li,{children:"\u2705 Perfect for user-facing applications"}),"\n",(0,n.jsx)(t.li,{children:"\u274c More complex setup for simple integrations"}),"\n",(0,n.jsx)(t.li,{children:"\u274c Overkill for basic server-to-server calls"}),"\n"]}),"\n",(0,n.jsx)(t.h3,{id:"api-keys",children:"API Keys"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:"\u2705 Dead simple - just add to headers"}),"\n",(0,n.jsx)(t.li,{children:"\u2705 Perfect for server-side integrations"}),"\n",(0,n.jsx)(t.li,{children:"\u2705 Faster time-to-first-API-call"}),"\n",(0,n.jsx)(t.li,{children:"\u274c Need to handle security and rotation manually"}),"\n",(0,n.jsx)(t.li,{children:"\u274c Less suitable for applications with end users"}),"\n"]}),"\n",(0,n.jsx)(t.h2,{id:"the-right-tool-for-the-job",children:"The Right Tool for the Job"}),"\n",(0,n.jsx)(t.p,{children:"OAuth 2.0 was the right foundation - it handles complex authentication flows and gives us room to grow. But after building my own integrations, I've seen that many use cases are straightforward server-to-server calls where API keys just make more sense."}),"\n",(0,n.jsxs)(t.p,{children:["Think about it: if you're building a ",(0,n.jsx)(t.a,{href:"/docs/guides/collection-management",children:"collection management system"})," that syncs card data every night, or a ",(0,n.jsx)(t.a,{href:"/docs/guides/data-analysis",children:"pricing tool that pulls market data"})," for analysis, you don't need the complexity of OAuth flows. You just need authenticated access to the data."]}),"\n",(0,n.jsx)(t.h2,{id:"real-world-examples",children:"Real-World Examples"}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.strong,{children:"Perfect for OAuth 2.0:"})}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:"A mobile app where users authenticate to track their personal collections"}),"\n",(0,n.jsx)(t.li,{children:"A web platform where multiple users manage shared inventories"}),"\n",(0,n.jsx)(t.li,{children:"Any application where end users need to authorize access to their data"}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.strong,{children:"Perfect for API Keys:"})}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:"Server-side scripts that sync card data"}),"\n",(0,n.jsx)(t.li,{children:"Collection management systems for card shops"}),"\n",(0,n.jsx)(t.li,{children:"Data analysis tools and market research platforms"}),"\n",(0,n.jsx)(t.li,{children:"Simple integrations that just need card information"}),"\n"]}),"\n",(0,n.jsx)(t.h2,{id:"our-authentication-roadmap",children:"Our Authentication Roadmap"}),"\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.strong,{children:"Coming soon:"})," Simple API key authentication alongside our existing OAuth system."]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.strong,{children:"The plan:"})}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:"API keys for server-to-server integrations (most use cases)"}),"\n",(0,n.jsx)(t.li,{children:"OAuth for applications that need user authorization flows"}),"\n",(0,n.jsxs)(t.li,{children:["Same ",(0,n.jsx)(t.a,{href:"/docs/api/endpoints",children:"endpoints"}),", same data, choose what fits your project"]}),"\n",(0,n.jsx)(t.li,{children:"Clear documentation for when to use each approach"}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:"Having both options means developers can pick the authentication method that matches their use case, rather than forcing everyone into one approach."}),"\n",(0,n.jsx)(t.h2,{id:"getting-started-today",children:"Getting Started Today"}),"\n",(0,n.jsxs)(t.p,{children:["Right now, ",(0,n.jsx)(t.a,{href:"/docs/getting-started/authentication",children:"OAuth 2.0 is your path to accessing the Trading Card API"}),". Our documentation walks you through the ",(0,n.jsx)(t.a,{href:"/docs/getting-started/authentication",children:"client credentials flow"}),", which is actually pretty straightforward for server-side applications."]}),"\n",(0,n.jsxs)(t.p,{children:["But if you're waiting for API keys because OAuth feels like overkill for your project, ",(0,n.jsx)(t.a,{href:"mailto:[email protected]",children:"reach out"})," - I'd love to hear about your use case."]}),"\n",(0,n.jsx)(t.h2,{id:"questions",children:"Questions?"}),"\n",(0,n.jsxs)(t.p,{children:["Have thoughts on OAuth vs API keys for trading card data? Building something that would benefit from simpler authentication? I'd love to hear from you - drop me a line at ",(0,n.jsx)(t.a,{href:"mailto:[email protected]",children:"[email protected]"})," or connect with me on ",(0,n.jsx)(t.a,{href:"https://twitter.com/cardtechie",children:"Twitter"}),"."]}),"\n",(0,n.jsx)(t.hr,{}),"\n",(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.strong,{children:"Ready to get started?"})," Check out our ",(0,n.jsx)(t.a,{href:"/docs/getting-started/overview",children:"Getting Started guide"})," or dive into the ",(0,n.jsx)(t.a,{href:"/docs/api/endpoints",children:"API documentation"})," to begin building with Trading Card API today."]})]})}function h(e={}){const{wrapper:t}={...(0,r.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}i.d(t,["assets",0,o,"contentTitle",0,"OAuth 2.0 vs API Keys: Why OAuth Won","frontMatter",0,{title:"OAuth 2.0 vs API Keys: Why OAuth Won",authors:["tradingcardapi"],tags:["oauth","api-keys","authentication","security","developer-experience"],description:"A deep dive into why we chose OAuth 2.0 for Trading Card API and why we're adding API key support for simpler integrations.",image:"/blog/images/oauth-vs-api-keys.png",published:"2025-09-24 20:23:00"},"toc",0,[{value:"The Reality of OAuth 2.0 vs API Keys",id:"the-real

1ity-of-oauth-20-vs-api-keys",level:2},{value:"OAuth 2.0",id:"oauth-20",level:3},{value:"API Keys",id:"api-keys",level:3},{value:"The Right Tool for the Job",id:"the-right-tool-for-the-job",level:2},{value:"Real-World Examples",id:"real-world-examples",level:2},{value:"Our Authentication Roadmap",id:"our-authentication-roadmap",level:2},{value:"Getting Started Today",id:"getting-started-today",level:2},{value:"Questions?",id:"questions",level:2}]])},7451(e,t,i){i.d(t,{A:()=>o});i(6540);var a=i(6025);const n="blogImageContainer_EoU9",r="blogImage_aPSe";var s=i(4848);function o({src:e,alt:t,className:i}){const o=(0,a.Ay)(`/blog/images/${e}`);return(0,s.jsx)("div",{className:`${n} ${i||""}`,children:(0,s.jsx)("img",{src:o,alt:t||"Featured image from the Trading Card API sports card and trading card data blog",className:r})})}},8453(e,t,i){i.d(t,{R:()=>s,x:()=>o});var a=i(6540);const n={},r=a.createContext(n);function s(e){const t=a.useContext(r);return a.useMemo(function(){return"function"==typeof e?e(t):{...t,...e}},[t,e])}function o(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:s(e.components),a.createElement(r.Provider,{value:t},e.children)}},570(e){e.exports=JSON.parse('{"permalink":"/blog/2025/09/24/oauth-vs-api-keys-authentication-methods","editUrl":"https://github.com/cardtechie/tradingcardapi-api/tree/master/docs/public/blog/2025-09-24-oauth-vs-api-keys-authentication-methods.md","source":"@site/blog/2025-09-24-oauth-vs-api-keys-authentication-methods.md","title":"OAuth 2.0 vs API Keys: Why OAuth Won","description":"A deep dive into why we chose OAuth 2.0 for Trading Card API and why we\'re adding API key support for simpler integrations.","date":"2025-09-24T00:00:00.000Z","tags":[{"inline":true,"label":"oauth","permalink":"/blog/tags/oauth"},{"inline":true,"label":"api-keys","permalink":"/blog/tags/api-keys"},{"inline":true,"label":"authentication","permalink":"/blog/tags/authentication"},{"inline":true,"label":"security","permalink":"/blog/tags/security"},{"inline":true,"label":"developer-experience","permalink":"/blog/tags/developer-experience"}],"readingTime":2.79,"hasTruncateMarker":true,"authors":[{"name":"Trading Card API Team","title":"Developer Relations","url":"https://tradingcardapi.com","imageURL":"https://github.com/cardtechie.png","email":"[email protected]","key":"tradingcardapi","page":null}],"frontMatter":{"title":"OAuth 2.0 vs API Keys: Why OAuth Won","authors":["tradingcardapi"],"tags":["oauth","api-keys","authentication","security","developer-experience"],"description":"A deep dive into why we chose OAuth 2.0 for Trading Card API and why we\'re adding API key support for simpler integrations.","image":"/blog/images/oauth-vs-api-keys.png","published":"2025-09-24 20:23:00"},"unlisted":false,"prevItem":{"title":"Build a Sports Card Price Tracker","permalink":"/blog/2026/08/09/building-a-sports-card-price-tracker"},"nextItem":{"title":"v0.4.0: Rate Limits and Usage Analytics","permalink":"/blog/2025/09/11/trading-card-api-v040-release"}}')}}]);