Over the next several months HathiTrust will be implemeting security enhancments to the Data API. The enhancements will require developers using the
API to acquire an OAuth 1.0 access key that identifies them, and a secret key that must be used to “sign” URLs to retrieve HathiTrust resources
via the Data API. HathiTrust will also provide a Web client that employ’s a user’s login credentials as a proxy for these keys to facilitate
non-programmatic uses. In March, staff at the University of Michigan integrated 2-legged OAuth into the Data API and began to develop the Data API
client. Once OAuth is released, there will be an approximately 6-month transition period, ending October 1, 2012, during which signed access to the
Data API will be possible but not required. After October 1, all requests to the Data API will need to be properly signed with an access key retrieved
from HathiTrust. Complete documentation of the security enhancements and methods of obtaining keys and accessing the Web client is forthcoming. OAuth
is planned for release in April 2012. |