Avoiding replacing API Key of the backend workflows every year

Questions
1

Hi everyone!

If a client wants to call an API workflow in my app, he has to include an API Key (or token) generated in the header, but this token will be revoked automatically and should be replaced every year.

The problem is that my users use the API key in many different calls, so every year they have to generate a new key and edit their calls to replace the old key. this could be time-consuming and a cause of many errors.

So is there a workaround to avoid replacing the token every year?
Is it practical and secure if I removed the authentication from being in the header and made a body parameter for this?

2

What I understand is that you have created your own auth system for API workflow? This is your choice to revoke API key after a year. You can change that… Did you consider Bubble password oauth process instead?

3

@Jici
I have made API workflows that users can call from their apps and I implemented the authentication method explained here:

Is there a resource for the “Bubble password oauth process” in the bubble documentation?