Authentication
Authentication is the process of verifying the identity of the user, application, or system making a request.
It answers:
Who are you?
How It Works
An API may require credentials before allowing access.
Common mechanisms can include:
The appropriate method depends on the service and risk involved.
HTTP also provides standardized authentication mechanisms. MDN's HTTP authentication guide explains the general request-and-challenge framework used by HTTP authentication schemes.
Authentication vs. Authorization
Authentication answers:
Who are you?
Authorization answers:
What are you allowed to do?
A system can successfully authenticate an application while still refusing an operation because that application does not have sufficient permissions.
Why It Matters
APIs often expose information or actions that should not be available publicly.
Authentication can help protect:
- Customer information
- Content-management actions
- Orders
- Payment operations
- Account data
- Administrative systems
But authentication alone does not guarantee that the access granted is appropriate.
Common Problems
Common problems include:
- Credentials in public source code
- Shared credentials
- Former staff retaining access
- Tokens never expiring or rotating
- Production and development credentials mixed together
- More access granted than the integration requires
How to Improve
Use the authentication mechanism recommended by the API provider.
Store secrets appropriately, restrict credentials where possible, and document who owns them.
Google's security guidance, for example, recommends restricting API keys, separating them by application, and protecting server-side credentials from public exposure. Google Maps Platform API security guidance