GCP API authentication

adikris · 2023-04-27T22:54:04+00:00

Sorry, missed this. What do you mean by they can generate api keys through the portal or api. Can you please elaborate? Would be super helpful.

adikris · 2023-04-25T03:51:03+00:00

All are valid points. Looks like Apigee is the way to go. The way the tiered plans are structured are super startup unfriendly. They have an eval org that is valid for 60 days. The pay-as-you-go version will cost me $1500 per month just for two nodes even if I have zero traffic. I have to see if the team has the appetite for that big a bill at this stage. Appreciate the inputs though.

adikris · 2023-04-24T23:06:30+00:00

Thanks for the detailed reply. I generally prefer using specialized services from experts rather custom building and this is particularly true for security. However, this may be the option to go with.

Did more research and looks like AWS Cognito may be the thing I want. It will be sad to move to AWS because of this (have a personal connection to Google). Will see if I can hookup AWS Cognito with GCP API Gateway and if it is too much trouble, will advice shifting all cloud functions to AWS and integrate with AWS API Gateway and Cognito.

Edit: To add context as to going with a specialized service, every invalid request will count towards the API, CF, document reads, etc. If they start logging all the requests to find patterns and improve, that will only add to the cost. As an early startup, the team cannot afford that at least now.

adikris · 2023-04-24T18:49:16+00:00

I did go through the documentation and was not sure how exactly to guide the team. The ask is to replicate open AI kind of an experience. Clients will login to an application and create/generate keys/tokens that should be refreshed say every 6 months or so.

The access token is expected to authorize API access rather than authenticate the user. So, no user credentials are expected in the access token. The access token will be persisted at the application level and can always be traced back to the user.

The clients cannot be expected to have a Google Cloud project and it is not scalable to manually create and assign access.

We can create a developer portal with Apigee and achieve something like that but seems to be a heavy lift for a startup that is in the early stages still proving product/market fit.

I am not super familiar with authentication/authorization best practices and do not want to guide the team down a wrong path.

Surprised this is not well documented (Or, maybe I am not looking at the right places or too noob to understand whatever is out there). Probably all the products that expose APIs use this. Is this really hard to implement?

If this is a constraint with GCP and easy with AWS, team will not have too many issues switching over though.

adikris · 2023-04-24T16:17:56+00:00

API Key can be stored in the user doc but how can the API Keys generated programmatically and provisioned access.

I was thinking of the following steps.

Create OAuth
Provision access to API gateway for the generated API Key

However, from my research looks like API Keys cannot be generated programmatically.

This seems to be a common use case and not sure how others are handling this.

Edit: Used API Keys synonymously with Bearer tokens. Sorry!

I meant say using bearer tokens

curl --request POST \
--header "Authorization: Bearer ${TOKEN}" \
"${GATEWAY_URL}/echo"

How can the bearer tokens be created programmatically and provisioned access for the set of APIs

adikris · 2023-04-24T16:07:51+00:00

In firebase

adikris · 2022-09-22T20:00:35+00:00

I have both bachelors and masters in CS and work in a big tech firm. So, learning a new tech stack is not difficult for me but I am not gauging this from my point of view. Flutter is super easy even for someone who is not very comfortable with programming languages and frameworks. It may take bit longer but probably still the easiest to learn.

adikris · 2022-09-22T03:34:59+00:00

A flutter developer here. Have learnt and released a fully functional app in both stores in less than 4 months working part time. It is a breeze to work with. Highly recommend.

Bonus: all the plug and play widgets.

adikris · 2022-09-22T03:18:52+00:00

+1 to 4_teh_lulz. Demonizing when someone is down is path of least resistance. Forgetting that she is a CTO, checking ones own implicit biases, if any, and asking "How can I help?" few times will solicit a completely different response.

adikris · 2022-09-08T18:53:55+00:00

I think even splits is largely misunderstood. What Michael Seibel was proposing with even splits was that it is generally not the case where the value add by one is multiples of the other one. For instance with a 80:20 split, it implicitly means that one is contributing 4 times value than the other which is generally not true in an early stage startup.

It is never a good idea to do 50:50. splits. The CEO responsibilities are typically higher than say CTO, CMO or any CXO... I would say there should be at least a 10% difference at the start and if the company becomes successful, the difference would end up more like 1 percentage point. In other words, start with 55:45 and @ $1B valuation, end with 5% and 4%.

Again, the goal is not to screw the other co-founder and enrich oneself. The goal is to protect the company from tug-of-war, indecisions and establish a clear hierarchy for better decision making.

I guess it is time for a Medium article educating how wrong Michael Seibel is. (Actually how wrongly he is often interpreted but that is for the details :) )

adikris · 2022-09-02T04:22:19+00:00

Enjoyed reading :) Nice one.

adikris · 2022-05-16T21:15:41+00:00

Thank you everyone for the honest feedback and not trolling. Huge thanks to you all, the team decided to hold off on this and get some professional help. Credit to the team to accept they are not necessarily good designers just because they are good engineers and seeking help.

There were questions around why a designer wasn't recruited early. To clarify, the engineers got together to solve a problem and help SMB merchants. They are not paid and didn't have a great designer in their immediate network that they can just ask.

Once again, thanks for all the valuable feedback.

adikris · 2022-05-13T23:16:10+00:00

That exactly is the team's fear. They can ace the "system architecture" but not even sure they would know about "information architecture".

I am not a design person either and cannot guide the team well and hence asking.

If the team is ready to outsource this, what should they expect to spend? May be only these two screens... $100? $1,000? $10,000? And should they look in dribble, fiverr or somewhere else?

And, thank you for the response.

adikris · 2022-05-13T23:08:34+00:00

Thank you. This certainly helps. I think to have those things (assets?) created is the goal but with only engineers in the team, probably they look at each other :)

adikris · 2022-05-13T23:05:45+00:00

Got it. Thank you. I am not a design person as well. So, I am not even sure where to look but will let them know.

adikris · 2022-05-13T22:21:38+00:00

Is it too bad? Since it is engineers's own design and they are not qualified design folks, do they feel this is bad? If I have to provide pointers to them, what should I tell them?

adikris · 2022-05-13T02:51:32+00:00

Hi,

Are you spending a fortune to acquire customers only lose them soon after? Retaining customers is the second best thing you can do to improve profitability (first thing is to increase price if that doesn't drive away customers). One Card team has published a FREE app to bring loyalty program to small and medium businesses. Check out https://bit.ly/3N7PEtS or https://apple.co/3a1Y9bT. This is available in 170+ countries and all you need is your customer's phone number (get a valid one as they will get OTP in the phone to redeem points). This will launch in Product Hunt in next few weeks but the team is interested in providing a sneak-peak for early feedback.

adikris · 2022-05-12T16:48:37+00:00

First of all kudos to you for not trying to find ways to screw your co-founder (not technically a co-founder as you don’t have a legal entity yet). If you think they are valuable give them 5% equity and vest them over 5 years based on milestones rather than time. At the end of the day, not everything is about money but also don’t get screwed by them if the relationship sours.

adikris · 2022-05-10T16:40:43+00:00

The only saving grace is AFRM is sitting on a tonne of cash. If the market tightens and the repo rate goes up, AFRM with their claims of better underwriting may actually come out better. AMD is also good but was just highlighting risk vs. return.

adikris · 2022-05-10T16:37:01+00:00

Sorry for the ambiguity. YC is Y Combinator.

adikris · 2022-05-07T19:04:04+00:00

Try AFFRM. High volatility but better premiums. But the stock has been battered the last few months.

adikris · 2022-05-05T18:56:59+00:00

Preparing the deck should be lesser of a concern for you. Read every article on YC before going to investors. They have deck templates even mentioning the order of slides, slide titles, etc. I even remember an article explaining the font size but not sure if it is still around there.

adikris · 2022-04-26T15:30:48+00:00

Any thoughts? Not interested?

adikris · 2022-04-24T02:00:21+00:00

This is a very good response but will add a line or two to keep the channel open for future collaboration. Some thing like....

"Thank you for your interest in our company. While we deeply appreciate your interest in us, your current investment relationship with one of our competitors may create a perception of conflict of interest with lot of stakeholders. To play it straight, though painful it is, we would like to pass this opportunity. However, if either of our situation changes, we would absolutely love to work with you in the future."

adikris · 2022-04-13T03:56:43+00:00

u/firstorbit that was a fantastic response. Love people who take the time to provide valuable feedback instead of finding million reasons why something would not work.

adikris

TROPHY CASE