Hack the Route Start free Open app Identity and access
API authentication
How a program proves who it is to an API: a password on every request (Basic), a token it got once (Bearer), or a key.
HTTP Basic sends Authorization: Basic <base64 of user:password> on every request: base64 is an encoding,
not encryption, so it needs HTTPS. A bearer token is handed out once for a password and sent as
Authorization: Bearer <token>; it expires and can be revoked, but anyone who holds it is let in, and changing the
password does not revoke tokens already issued. An API key is a long-lived secret in its own header
(X-API-Key), often with limited rights. A server answers 401 when it does not know who is asking (with a
WWW-Authenticate header saying how to authenticate) and 403 when it knows and refuses.