API AUTHENTICATION | QA SDET
API Authentication Summary
API authentication is the process of verifying the identity of a user or system before allowing access to an API. Here's a quick summary of common methods:
1. API Key: A simple static key included in headers or query params. Easy to implement but less secure. Best for internal or low-risk APIs.
2. Basic Auth: Uses Base64-encoded username and password. Suitable for quick testing or internal tools, but not recommended for production without HTTPS.
3. Bearer Token: A token (often a JWT) passed in the Authorization header. Widely used in modern APIs for secure, stateless authentication.
4. OAuth 2.0: A robust framework allowing token-based authentication using flows like Authorization Code or Client Credentials. Common in third-party integrations and social login.
5. JWT (JSON Web Token): A compact, self-contained token format used mostly in Bearer authentication. Ideal for stateless APIs and mobile apps.
6. Digest Auth: A more secure version of Basic Auth using hashing. Rarely used now due to complexity and modern alternatives.
7. HMAC: Uses a hashed signature with a secret key to verify authenticity. Common in high-security APIs like banking and trading platforms.
8. Mutual TLS (mTLS): Both client and server authenticate using certificates during the SSL handshake. Used in enterprise and financial systems.
9. Session-based Auth: The server creates a session after login, and the client uses a cookie or session ID. Common in traditional web apps.