title: Best way to secure a WCF service on the internet with few clients
body: <p>I am looking to expose a service to a selection of clients over the internet. At this stage the api is very small, and I only want known clients to be able to access the service. I don't need to be able to identify the clients now, however I envisage that in future I will need to be able to identify clients, as the api grows.</p>
  
  <p>I'm wondering what the best way to secure the service is in the short term, with a view to the longer term where I may want to be able to authorise client access to specific methods on the service?</p>
  
  <p>I was thinking of using Transport security - i.e. SSL. Should I also look at using Message security with </p>
  
  <pre><code>clientCredentialType="certificate"
  </code></pre>
  
  <p>in which clase each client will have their own certificate that will authenticate them with the service?</p>
  
  <p>Or should I simply provide each client an API key which will provide a similar level of client differentiation?</p>
  
  <p>Any other suggestions welcome. </p>
  
  <p>Note that this is a service to service interface - i.e. not a client application. The number of users of the service will be limited, and I don't foresee needing to apply security at the data level, moreso at the method access level. </p>