API authentication methods

Overview

An API authentication method is how a client proves its identity on each request. The common options are Basic authentication (username and password on every request, only over HTTPS), API keys (a long random secret identifying an application), bearer tokens such as JWTs or opaque tokens (issued after login and sent in the Authorization header), OAuth 2.0 (delegated access tokens for users and third-party apps), and mutual TLS (both client and server present certificates).

The right choice depends on who the caller is. Server-to-server integrations often use API keys or OAuth client credentials; user-facing apps use OAuth/OIDC tokens or sessions; high-security internal traffic uses mTLS. Most production APIs combine methods and add scopes, rotation, and rate limits per credential.

When to use it

• Designing how clients call your API.
• Choosing credentials for partners, mobile apps, and internal services.
• Security reviews of existing APIs.

Where it shows up in interviews

Where it is used in real software

Key terms

Basic auth

Base64-encoded username:password in the Authorization header.

API key

Long random secret identifying a client application.

Bearer token

Token whose possession grants access (Authorization Bearer header).

Scope

Limits what a token or key is allowed to do.

mTLS

TLS where the client also presents a certificate.

How it works, step by step

1. 1
   Identify the caller type

   End user, third-party app, partner server, or internal service.

2. 2
   Pick the method

   OAuth/OIDC for users and delegated access, API keys or client credentials for servers, mTLS for internal traffic.

3. 3
   Send credentials safely

   Only over HTTPS, in the Authorization header, never in URLs or logs.

4. 4
   Store and verify securely

   Hash API keys at rest; validate token signature, expiry, audience, and scopes.

5. 5
   Rotate and revoke

   Support multiple active keys, short-lived tokens, and immediate revocation.

Method comparison

Choose by caller and risk

Match the method to who is calling; combine with scopes, rate limits, and rotation.

Implementation

1import { createHash, timingSafeEqual } from "node:crypto";2 3// API keys: store only a hash, show the full key once at creation4const hash = (key: string) => createHash("sha256").update(key).digest();5 6async function authenticate(req: Request): Promise<{ clientId: string; scopes: string[] }> {7  const header = req.headers.get("authorization") ?? "";8  const [scheme, credential] = header.split(" ");9  if (scheme === "Bearer" && credential?.startsWith("sk_")) {10    const record = await apiKeys.findByPrefix(credential.slice(0, 12));   // prefix index, not the secret11    if (record && timingSafeEqual(record.hash, hash(credential)) && !record.revoked) {12      return { clientId: record.clientId, scopes: record.scopes };13    }14  }15  if (scheme === "Bearer") {16    const claims = await verifyJwt(credential, { audience: "orders-api", issuer: "https://auth.example.com" });17    return { clientId: claims.sub, scopes: String(claims.scope ?? "").split(" ") };18  }19  throw new HttpError(401, "UNAUTHENTICATED", "Missing or invalid credentials");20}21 22function requireScope(scopes: string[], needed: string) {23  if (!scopes.includes(needed)) throw new HttpError(403, "FORBIDDEN", `Scope ${needed} required`);24}

Complexity and performance

Trade-offs

Variants and related techniques

Common mistakes

• API keys in query strings or client-side code.

  Fix: Send in headers; keep secret keys server-side only; use publishable keys for browsers.

• Storing API keys in plain text.

  Fix: Store hashes and show the full key only once.

• Long-lived tokens without scopes.

  Fix: Short expiry, least-privilege scopes, and refresh tokens.

Interview questions

Practice problems