Grokking Modern API Design Interview
Vote

0% completed

​

Authentication and Authorization for APIs

A request carries a valid token:

DELETE /payments/pay_81M
Authorization: Bearer <token>

The server must still refuse it. The token proves an identity; it does not automatically grant every operation on every resource.

This lesson separates two questions. Authentication: who is calling, and is the credential valid? Authorization: may that identity perform this operation on this resource?

Confusing them produces confusing status codes, overpowered credentials, and data leaks.

.....

.....

.....

Like the course? Get enrolled and start learning!