title: API access authentication/application key (django/nginx/gunicorn)
body: <p>I have a web app created in django, running in gunicorn app server behind nginx webserver/reverse-proxy. I need to have external application to access some processed data (csv/json), for which I need some sort of authentication. The basic django auth/login is not optimal as a simple script needs to pull the data with a simple request, no cookies etc (not created by me).</p>
  
  <p>For now, I have </p>
  
  <ol>
  <li><p>set up the service being available with https/tls only  </p></li>
  <li><p>created an IP-filter in django to reduce the "attack surface" with:</p></li>
  </ol>
  
  <p><code>request.META['HTTP_X_REAL_IP']</code></p>
  
  <p>and using nginx to forward the ip with:</p>
  
  <pre><code>proxy_set_header X-Real-IP $remote_addr;
  </code></pre>
  
  <p>Next I was thinking to include and application key (hash of a pw or something) which needs to be included in the request, and is checked against db for a list of valid keys. </p>
  
  <p>Is this a suitable api authentication or is there something else which can be used/recomennded? some sort of application key framework? </p>