I am working on a personal project to build a REST authentication system which authenticate clients via three parameters:
apikey = example-apikey-34433
hash = examplehash-notarealhash-a34io4oehosseesr
timestamp = 2000000000
Every client has a unique apikey and secret key, stored in a database.
Hash is a SHA256 hash of the secret key + timestamp. This is to generate a unique authentication hash for every request.
Would this be secure against brute forcing? Because when a client can supply any timestamp, is it true that multiple hashes can be correct?
Wouldn't it be better to just rely on the apikey and (plain text) secret key? Or do you know a better way to do this?