how to secure web api for clients who distribute their application to unknown/unverified users?

How can I sec开发者_开发技巧ure an webservice so my clients can use it on their applications without having to fear that their api keys will be used in other applications?

---

Assuming that:

1. you're using WCF to implement your services
2. You are writing some webservices for your client, so they will host the webservices.

Take a look at the WCF Security Guidance from P&P group: http://wcfsecurity.codeplex.com/

It helped us a lot in defining our security strategy, based on our requirements.

In summary you need to understand how your webservices will be used, what your users will be authenticated and authorized, and based on this, implement the required configuration/code changes.

I hope this helps.

Wagner.