Card 11/ 12
Practice: Choosing How Four Clients Authenticate
A partner's batch job, a single-page app, an internal payments service and a mobile app.
Choosing how a client authenticates means answering the four questions for that client. An online shop's API has four callers. Choose a method for each, and say how its access would be cut off.
- A logistics partner's nightly batch job, running on the partner's servers.
- The shop's own single-page web app, served from the same site as the API.
- The shop's internal payments service, called by the orders service.
- The shop's mobile app, acting for a signed-in customer.
Show the answers
| Client | Method | Where it travels | How access is cut off |
|---|---|---|---|
| Partner batch job | API key, or OAuth client credentials | A request header | Revoke the partner's key |
| Own single-page app | Session | An HttpOnly, Secure, SameSite cookie | Delete the session |
| Payments service | Mutual TLS | The TLS handshake | Stop renewing the orders service's certificate |
| Mobile app | OAuth access tokens, short-lived, with a refresh token | Authorization: Bearer | Revoke the refresh token; the access token expires within minutes |
The mobile app must not carry an API key: anything shipped in an app can be extracted, and one stolen key would speak for every installation. If the access tokens are JWTs, the API validates them with every check, and the short lifetime is what makes revocation workable.
← → move through sections and cards