QuickChart Authentication: Methods and Security Best Practices

Authentication overview

QuickChart, a service for generating static chart images and QR codes, implements authentication to control access to its API and protect user configurations. The service primarily offers two methods for authentication: signed URLs and direct API key usage. These methods serve different use cases, with signed URLs being recommended for client-side integrations where API secrets must remain confidential, and API keys for server-side applications where the key can be securely stored.

Proper authentication ensures that API requests originate from authorized sources, preventing misuse and maintaining the integrity of chart generation. QuickChart's approach to authentication is detailed in its official documentation, which outlines the setup and usage for both methods across various programming languages. It is essential to configure authentication correctly to prevent unauthorized chart generation or data exposure.

Supported authentication methods

QuickChart supports two main authentication methods, each designed for specific deployment scenarios:

1. Signed URLs: This method involves generating a unique, cryptographically signed URL for each chart request. The signature is created using your QuickChart API Key and API Secret. This approach is recommended when the chart request is initiated directly from a client-side application (e.g., a web browser or mobile app) or when the API Secret cannot be exposed directly to the client. The server-side component signs the URL parameters before sending them to the client, which then makes the request to QuickChart.
2. API Keys: For server-to-server communication or backend applications where the API Key can be securely stored and managed, direct API key usage is available. In this scenario, the API Key is included directly in the request parameters, typically as part of the query string. This method is simpler to implement but requires stricter control over the API Key to prevent unauthorized access.

The choice between signed URLs and API keys depends on the security requirements and architecture of your application. Signed URLs provide an additional layer of security by ensuring the authenticity and integrity of the request without exposing sensitive credentials on the client side.

Getting your credentials

To authenticate requests with QuickChart, you need to obtain your API Key and, for signed URLs, your API Secret. These credentials are generated within your QuickChart account dashboard.

1. Account Creation: First, create an account on the QuickChart website if you don't already have one.
2. Dashboard Access: Log in to your QuickChart account.
3. Locate API Credentials: Navigate to the 'API Keys' or 'Settings' section of your dashboard. QuickChart provides specific instructions on how to locate these credentials within the user interface. Your API Key and API Secret will be displayed there.

The API Key is a public identifier for your account, while the API Secret is a confidential key used for signing requests. It is imperative to keep your API Secret secure and never embed it directly in client-side code that could be publicly exposed. For server-side environments, store these credentials as environment variables or in a secure configuration management system rather than hardcoding them into your application code.

Authenticated request example

This example demonstrates how to generate a signed URL for a QuickChart request using Python. This method is suitable for scenarios where the client-side application needs to request a chart without exposing the API Secret.

import quickchart
import hashlib
import hmac
import json

# Replace with your actual API Key and API Secret
API_KEY = "YOUR_API_KEY"
API_SECRET = "YOUR_API_SECRET"

# Chart configuration
chart_config = {
    "type": "bar",
    "data": {
        "labels": ["January", "February", "March", "April", "May"],
        "datasets": [{
            "label": "Sales",
            "data": [12, 19, 3, 5, 2]
        }]
    }
}

# Create a QuickChart instance
qc = quickchart.QuickChart()
qc.config = chart_config

# Set the API key and secret for signing
qc.set_api_key(API_KEY)
qc.set_api_secret(API_SECRET)

# Get the signed URL
signed_url = qc.get_signed_url()

print(f"Signed Chart URL: {signed_url}")

In this example, the quickchart Python library handles the signing process internally, abstracting the HMAC-SHA256 calculation. The get_signed_url() method returns a complete URL with the chart configuration, API key, and a generated signature. This URL can then be used in an <img> tag or any other context where a direct image URL is required. For detailed SDK usage and examples in other languages, refer to the QuickChart chart API reference.

Security best practices

Adhering to security best practices is critical when integrating any API, including QuickChart, to protect your credentials and user data.

• Protect API Keys and Secrets: Treat your API Secret as you would a password. Never hardcode API Keys or Secrets directly into client-side code or commit them to version control systems like Git. Instead, use environment variables, secure configuration files, or a secrets management service. For instance, cloud providers offer services like Azure Key Vault or AWS Secrets Manager for secure credential storage (AWS Secrets Manager documentation).
• Use HTTPS/TLS for All Communications: Ensure all API requests to QuickChart are made over HTTPS. This encrypts the data in transit, protecting sensitive information like chart configurations and API keys from eavesdropping. QuickChart inherently uses HTTPS for its API endpoints.
• Implement Signed URLs for Client-Side Access: Whenever charts are requested directly from a web browser or mobile application, utilize signed URLs. This practice prevents the exposure of your API Secret, as the signing process occurs on your secure backend server.
• Rotate Credentials Regularly: Periodically change your API Key and API Secret. This practice minimizes the risk window if a credential is ever compromised.
• Least Privilege Principle: If QuickChart were to offer different scopes or permissions, only grant the minimum necessary permissions to API keys required for specific tasks. While QuickChart's current authentication is generally all-or-nothing for chart generation, this principle is foundational for broader API security.
• Monitor API Usage: Regularly review your QuickChart API usage logs and billing details to detect any unusual activity that might indicate unauthorized access or misuse of your credentials.
• Validate and Sanitize Input: Before sending chart configurations to QuickChart, validate and sanitize all user-supplied input to prevent injection attacks or malformed requests that could lead to unexpected behavior or security vulnerabilities.

By following these best practices, developers can significantly enhance the security posture of their applications integrating with QuickChart and safeguard their API credentials.