API Authentication

Overview

API authentication confirms who or what is calling an application programming interface. Common mechanisms include API keys, signed requests, OAuth access tokens, mutual TLS certificates, session credentials, and workload identities issued to services.

A strong design validates credentials on every protected request, checks issuer and audience, limits token lifetime, prevents replay, and uses secure transport. Authentication can still fail through leaked keys, weak signature verification, insecure token storage, or unsafe recovery and issuance.

Teams should select mechanisms appropriate to the client type, rotate secrets, separate environments, and log authentication outcomes without recording sensitive credentials. Authentication proves an asserted identity but must be followed by authorization to decide which actions that identity may perform.

API Authentication verifies the client, workload, or user invoking an interface and must be separated from endpoint-level authorization and request validation.

API authentication verifies the identity of a client, user, or service before an application programming interface accepts protected requests. API authentication establishes caller identity, while separate authorization rules must still restrict what that authenticated caller can access or change.

For API Authentication, the trust decision should establish the identity of a client, user, or service before an application programming interface accepts protected requests and bind the result to the requested action and protected resource. Teams should test issuance, storage, validation, expiry, revocation, recovery, and privileged override for identity proof and credential state, rather than checking only a successful request. Logs concerning the API identity check and identity proof and credential state should support investigation without exposing reusable secrets or unnecessary personal data.

Review of API Authentication should compare permitted and rejected actions related to identity proof and credential state, confirm that recovery cannot bypass the primary safeguard, and remove obsolete access promptly.