Every Scheme, Side by Side

A map of all the commonly used API authentication types and when each one is the right answer.

Here is the whole field on one page. Each row is covered in depth later in the course.

SchemeCredentialBest forMain weakness
HTTP Basicuser:password, base64internal tools, quick scriptssends the password every request
HTTP Digesthashed challenge responselegacy devicesobsolete; weak hashes
API keylong random stringserver-to-server, identifying an appstatic, rarely rotated, no user identity
HMAC signingsignature over the requestwebhooks, payments, AWS-style APIsfiddly to implement; clock skew
mTLSclient certificateservice-to-service, regulated sectorscertificate lifecycle management
Session cookieopaque session idfirst-party browser appsCSRF; cross-site cookies get blocked
Bearer token / JWTsigned tokenSPAs, mobile, cross-origin APIsXSS storage risk; hard to revoke
OAuth 2.0delegated access tokenthird-party access to user datacomplexity; easy to misconfigure
OpenID ConnectID token (JWT)"sign in with…" loginoften confused with OAuth's access token
SAMLsigned XML assertionenterprise SSOXML; browser-only
TOTP / OTP6-digit codea second factorphishable; never a first factor alone
WebAuthn / passkeysdevice-held key pairphishing-resistant loginrecovery flows; device binding

Three questions that pick for you

  1. Who is calling — a person in a browser, or a machine? Browser pushes you toward cookies or tokens; machine pushes you toward API keys, mTLS, or OAuth client credentials.
  2. Is the caller first-party or third-party? Your own frontend can hold a session. Someone else's app must never hold your users' passwords — that is what OAuth exists for.
  3. Do the frontend and the API share a site? abc.com calling api.abc.com can use cookies comfortably. abc.com calling dfg.com is cross-site, and that changes everything — the whole cross-origin category of this course is about that case.

Example

Example · bash
# One request, five different ways to prove who you are

# 1. Basic — password on every call
curl https://dfg.com/api/me -u alice:s3cret

# 2. API key — identifies the application, not the human
curl https://dfg.com/api/me -H "X-API-Key: sk_live_9f2c..."

# 3. Session cookie — the browser sends this automatically
curl https://dfg.com/api/me -H "Cookie: sid=8f2b..."

# 4. Bearer token — explicit, attached by your code
curl https://dfg.com/api/me -H "Authorization: Bearer eyJhbGci..."

# 5. mTLS — the credential is the TLS handshake itself
curl https://dfg.com/api/me --cert client.pem --key client-key.pem

When to use it

  • A team building a public SaaS ships OIDC login for humans, API keys for customer server integrations, and OAuth for third-party marketplace apps — three schemes, three audiences.
  • An internal admin tool behind a VPN uses Basic auth because the threat model does not justify anything more and the tool has four users.
  • A payments provider signs webhook deliveries with HMAC so the receiver can prove the request really came from them and was not replayed.

More examples

Decision shortcut

Everything after this in the course is the detail behind one of these lines.

Example · bash
Your own browser app, same site as the API
  → session cookie (HttpOnly, Secure, SameSite=Lax) + CSRF protection

Your own browser app, different site from the API (abc.com → dfg.com)
  → bearer access token in memory + refresh token, OR move the API to
    api.abc.com and keep cookies (see the BFF pattern)

Mobile / desktop app
  → OAuth 2.0 Authorization Code + PKCE, then bearer tokens

Another company's app acting for your users
  → OAuth 2.0 (never share passwords)

One of your servers calling another of your servers
  → mTLS, or OAuth client credentials, or a rotated API key

A webhook you send to a customer
  → HMAC signature over body + timestamp

Layering, not choosing

Each layer answers a different question. Skipping the last line is how authenticated users end up reading each other's data.

Example · bash
Browser (abc.com)
   │  OIDC login at accounts.abc.com          ← who is the human
   │  access token, 10 min, in memory         ← calling the API
   ▼
API gateway (dfg.com)
   │  verifies JWT signature + audience       ← authentication
   │  checks scopes                           ← coarse authorization
   ▼
Internal services
   │  mTLS between pods                       ← service identity
   │  row-level ownership checks in SQL       ← the check people forget

Discussion

  • Be the first to comment on this lesson.