Title Integrating OAuth open protocol with ServicesAPI to make it more secure and risk free
Student sumit kataria
Mentor Rob Loach
Abstract
In today's web, people do not like to share or exchange all their stuff on one service. Today, we prefer to use Flickr for photos, YouTube for videos, Amazon for shopping, etc. In order to make integration of different web services (in order to satisfy all customer/user needs), APIs using Services API in a secure fashion are used. To provide a secure way of this type of communication, OAuth open protocol is a very good option. The current system of API keys used by Services API is a combination of user name and password, but this key is too unsafe to share around on web. Also this key cannot be unshared once it is shared or handed over to other web service. The token provided by OAuth system will provide a much safer and risk free browsing experience to users.
Integration of OAuth 1.0 core to Drupal's Service API will provide users/administrators a pluggable authentication system such that they can choose between the current system of API keys, or OAuth token system to access desired web services. The method OAuth uses is to provide “tokens” to users instead of keys. Now for each kind of web service, OAuth issues a different kind of token to user. Also, these tokens are time bound an amount of access time to another service and then it expires automatically (could be a two hour access time).

Does this mean that OAuth is like OpenID?
The OAuth approach might be considered better than the OpenID approach as users don't have to do anything to undertstand it. They just browse normally with their existing methods but in a secure manner.

OAuth integration with Service API will rescue users, and developers, who put themselves at risk by sharing their private information.