US 2026/0244731 A1 · Second Factor Authentication for Application Programming Interfaces

Abstract

A method is provided for second-factor authentication in API environments that binds API access to a client device's physical location, leveraging authorized Wi-Fi networks as a proximity-based factor. The client device registers a list of Wi-Fi networks and, upon detecting at least one such network, generates an encrypted token. This token includes data such as time-limited nonces and device identifiers, ensuring replay protection and verifiable authenticity. The token is transmitted alongside a first-factor credential (e.g., an API key, OAuth token, or mutual TLS certificate) in an API request to the server. The server validates the token using a cryptographic key to confirm that the client device is indeed at the legitimate physical location. If successful, the request proceeds, potentially allowing sensitive operations such as certificate management by a CA. The method includes preventing Wi-Fi spoofing via local handshakes, updating the network list securely, and maintaining audit logs for compliance.

Claims20

Dependent claims

A method for providing second-factor authentication for an application programming interface (API) in a computing environment, the method comprising:

subsequent to registering a list of Wi-Fi networks corresponding to a legitimate physical location for a client device, receiving, from the client device, an API request directed to an API server, the API request including (i) a first-factor credential, and (ii) an encrypted token generated by the client device upon detecting at least one authorized Wi-Fi network from the list;
verifying that the first-factor credential corresponds to a recognized client device;
validating the encrypted token using a cryptographic key accessible to the API server;
and
upon successful validation of both the first-factor credential and the encrypted token, permitting the API request to proceed, wherein the authorized Wi-Fi network serves as a second factor to confirm that the client device is physically located at the legitimate physical location.

2 more elements

A non-transitory computer-readable medium storing instructions for providing second-factor authentication for an application programming interface (API) in a computing environment, the instructions, when executed, cause one or more processors in the computing environment to perform steps of:

subsequent to registering a list of Wi-Fi networks corresponding to a legitimate physical location for a client device, receiving, from the client device, an API request directed to an API server, the API request including (i) a first-factor credential, and (ii) an encrypted token generated by the client device upon detecting at least one authorized Wi-Fi network from the list;
verifying that the first-factor credential corresponds to a recognized client device;
validating the encrypted token using a cryptographic key accessible to the API server;
and
upon successful validation of both the first-factor credential and the encrypted token, permitting the API request to proceed, wherein the authorized Wi-Fi network serves as a second factor to confirm that the client device is physically located at the legitimate physical location.

2 more elements

Dependencies are inferred from the claim text.

Second Factor Authentication for Application Programming Interfaces

Life of this patent

Second Factor Authentication for Application Programming Interfaces

Life of this patent

Abstract

Claims20