Authenticating API Clients

Every request an API accepts was sent by someone, and before it does anything the API has to know who. Authentication is that proof. APIs have a handful of ways to ask for it, and they differ in what the caller holds, where it travels, which callers it suits, and how access is taken away when it should end.

The topic opens by separating authentication from authorisation, then maps the five methods against those four questions. API keys and bearer tokens come first, then a comparison of sessions and tokens. JSON Web Tokens get a card on their structure, a walkthrough of how a server validates one, and two gotchas: what anyone holding one can read, and why one is hard to revoke. Mutual TLS closes the family, and an exercise chooses a method for four clients.

It builds on 401 and 403 from the status codes topic. Who issues the tokens, and how an application gets one for a user, is the subject of the topic on OAuth 2.0 and OpenID Connect.

By the end you can tell authentication from authorisation, choose how a client authenticates, read the claims in a JWT, order the checks that validate one, say what anyone holding one can read, and plan how to revoke one before it expires.