API Access Control with OAuth Coordinating interactions with the Internet of Things. By Phillip J. Windley T he use of restful application programming interfaces (APIs) is growing quickly as more and more organizations determine that they can expand their core business by attracting developers and becoming a platform for online apps. This trend has been accelerated by the increasing use of mobile applications that rely on access to server-based data and processes to accomplish their work. The Iot lIcensed by Ingram publIshIng Digital Object Identifier 10.1109/MCE.2015.2421571 Date of publication: 15 July 2015 increased availability of connected consumer devices will further speed up API popularity. While some APIs can be used without authentication or authorization, the majority require some form of access control. For APIs that do not involve user accounts, the use of developer keys and secrets (a form of username/password access control) is sufficient. However, the most interesting use cases involve users authorizing an API to share their data with an application on their phone, a connected device, or another Web site using a protocol called OAuth. 52 IEEE ConsumEr ElECtronICs magazInE ^ july 2015 2162-2248/15©2015IEEE