[Domai.nr] API key required

[rakiru]

An API key is now required to use the domainr API. There's also a v2 API, but the old one should continue to work, so no big deal there (see #28).

{u'message': u'unauthorized: invalid API client ID'}

[rakiru]

Actually, this broke /because/ of #28. I forgot I updated all my plugins, which pulled down the now-broken version. Still, an API key will be needed moving forward. I would like to revert that PR in the mean time though.

[gdude2002]

Given that we were told the client ID was optional I thought it wouldn't break it in the meantime - reverting might be best until we have API keys

[rakiru]

Oops, I left this off a bit long. I'll get to it now.

@case Do you still want a client_id sent along with the API key? I'm not sure if you use them for statistics or anything.

Edit: Actually, this may all be in vain as it doesn't appear that you can sign up for an API key without entering credit card details. Is this the case?

[gdude2002]

@case Respectfully, I'm having issues with using Mashape for this given the number of navigational bugs on the site and the demand for a credit card for use with a "free tier". In this day and age, handing out your credit card details to random sites is a bad idea at best, and I don't feel that Mashape is trustworthy enough.

As much as I love Domainr and the services it provides, this is an open source project provided at zero cost to everyone, and due to my personal circumstances, I can't afford to go plugging my CC details into sites that.. Seem to require payment details for free tiers for some reason. Is there any possible alternative to this, or are we going to have to drop support?

[rakiru]

Just to add to what g has said, it's perfectly reasonable having a rate limit on a free tier, but having to enter payment details to access that free tier is quite the hurdle. Not all of our users are even in a position where they can provide such a thing. I'm also not sure if Mashape allows you to set limits, in which case I really wouldn't trust it with those details (and my limit would be $0 as I would personally only hit that many requests by accident, and it wouldn't need my details in that case anyway).

[case]

@rakiru yes, unfortunately a credit card is required to use the API via Mashape, even for the free tier. Presumably this is to curb abuse. (I asked them about this when we moved our self-serve API to their platform).

[rakiru]

Well, in that case, I guess I'll remove this plugin. Thanks for the API up to now, and good luck with it in future.

[case]

Thought of an alternative. We're fans and supporters of all things open source and developer tinkering, which definitely applies to you here. Email us at partners@domainr.com and we'll provide a client_id for your private, hobby-level use. As long as it doesn't get abused or shared broadly, you can keep using it for free. Ideally your query volume would stay within the free tier level listed on Mashape.

What we're trying to curb is the severe, high-volume abuse that inevitably happens when people find API keys floating around Github.

[gdude2002]

How does this solve the problem for our users? Won't they still need keys/IDs?

While I understand that concern, I feel like API keys can be somewhat over the top for the readonly sections of an API. That said, I also understand protecting against competitors from using it for scraping, so it seems understandable from that aspect.

Honestly, the only problem I really have with Mashape at this point is the credit card requirement - it just appears sketchy as it makes the system appear like a money grab, similar to what you see with American mobile operators - go over your data cap and you'll be charged infinitely. I totally agree with limiting APIs, and it makes a lot of sense, but a limit should be a hard limit in my opinion - I'd want it to stop working when I hit it.

Maybe I'm crazy, I don't know. Either way, I have no issues with an API requiring a key or being limited, and no issues telling our users to go get a key - Mashape just doesn't seem trustworthy. Your API itself is fine.