MEPX
Chapter 5 of 10All chapters
  1. 1What an API is
  2. 2The request
  3. 3The response
  4. 4REST and its alternatives
  5. 5Authentication
  6. 6JSON and data shapes
  7. 7Pagination and filtering
  8. 8Rate limits and retries
  9. 9Versioning and change
  10. 10Calling and debugging APIs

Chapter 5 of 10

Authentication

Proving who is calling.

The common schemes

An API key identifies an application. A bearer token, often a JWT, identifies a session or a user and expires. OAuth is how a user grants one service limited access to their data on another.

  • Send credentials in the Authorization header, never in the URL.
  • Short lived tokens with refresh are safer than one key that never changes.

Authorisation is separate

Knowing who is calling is not the same as deciding what they may do. Check permissions per resource on the server; hiding a button changes nothing.