API Authentication

guides

API Authentication

API authentication proves who is calling an API and authorizes what they can do. Most public APIs use one of four common schemes.

API Keys

An API key is a long secret string sent with each request, usually in a header (Authorization: Bearer <key>) or a query parameter (?api_key=...). Keys are simple to issue and revoke but must be protected like passwords. Never commit them to source control; load them from environment variables or a secrets manager.

Bearer Tokens

A Bearer token is an opaque string that authorizes whoever presents it (“bearer”). It is the default for Stripe, OpenAI, and SendGrid. Send it as Authorization: Bearer <token>. Tokens often expire and are refreshed through a separate flow.

OAuth 2.0

OAuth 2.0 lets a user grant a third-party application scoped access to their account without sharing their password. The client exchanges an authorization code for an access token, then calls the API with Authorization: Bearer <access_token>. PayPal, Google, and Firebase use OAuth 2.0 for user-context calls. Always validate the token scope and expiry.

HMAC Signatures

For high-security APIs (Adyen, Stripe webhooks) requests are signed with an HMAC of the body using a shared secret. The server recomputes the signature and rejects mismatches. This protects both authenticity and integrity.

Best Practices

  • Store secrets in environment variables or a vault, never in code.
  • Use HTTPS so credentials are encrypted in transit.
  • Rotate keys regularly and revoke compromised keys immediately.
  • Scope tokens to the minimum permissions required.
  • Log authentication failures and monitor for abuse.

Other languages