It might have something to do with HTTP headers and content type.
I think if you send your request as “text/plain”, it won’t be POST’ed properly.

There’s a simple firefox add-on called “poster”, which can help set the correct headers/content type and further troubleshoot the problem

Thanks, I’ll give it a shot to see if it works for me now as well.

Better is:
echo $this->Xml->header();

Works perfect, no need to set up header in view anymore.

Oh, and instead of:
echo ”;

I think better is:
Xml->header(); ?>

Thanks, that’s great. I’ll give it a shot once I come back around to this part of the project.

FYI, I’ve developed a plugin for Cake that does this & some more:
http://github.com/kvz/cakephp-rest-plugin

These are very good questions, and would supplement the article very well… but I wanted to stay on point.
That being said, there a few common solutions for the authentication.

1. IP restriction on the server side, basically if you have the IP(s) of the requesting server (such as a partner site), this is probably the “safest” way to control access… however it should be done in your firewall or server config.
2. Issue a token…
a. The user must first request an authorization.
b. You issue a token (some random string) which must be supplied with any following request… again combining this with something like a hashed IP + username would make the access even more secure.
c. This token would persist for a limited amount of time. Such scheme is used by many API’s including popular credit card gateways and your favorite sites like PayPal :)
3. You could agree with the third party on a specific public/private key combo and only allow access based on the fact that the both requirements are met.

The one point that’s a bit harder to control is the amount of hits to the API, again, IMO, this should not be handled on the application level, but rather at the server/firewall settings.

however, i would like to know your thoughts on api authentication.

what if the api user needs to be identified by a api_key and secret ?

is there an easy way to just make sure all api functions are protected by it ?

how can we take care of rate limiting if we are going to get hammered by hits ?

i know some of my questions are beyond the scope of your article but since i was working on an api, i was trying to answers these myself when i read your article :)

-mandy.