API authentication

What it means

API authentication is how an API establishes who is calling before it acts. Each request carries something that proves identity: an API key, a bearer token, a signed JWT, a client certificate. The server checks it, and only then does the work. A request that fails the check should be refused before any data is read.

It answers one question, who is this? It does not say what the caller may do. That is authorisation, and mixing the two up is the source of many API flaws. An API that checks the first but forgets the second will happily serve any caller anything.

Why it matters

APIs are the part of your product that other software, including attackers' software, can call at scale. If authentication is weak or missing on one endpoint, there is no web page in the way and no person to notice. Data can be pulled out quietly in volume, and the first sign may be a bill or a customer email.

Authentication failures sit near the top of every API risk list. OWASP's API Security Top 10 ranks broken authentication second, behind only broken object-level authorisation. Customers also ask how your API authenticates, and a vague answer costs deals. A clear one shortens the review.

How it shows up

Typical methods are API keys, OAuth 2.0 access tokens, JWTs and mutual TLS between services. Choose by who the callers are: people through an app, other servers, or partners. Each method has its own mistakes, such as tokens that never expire or signatures that are not checked.

Review every endpoint, not just the documented ones: old versions, internal routes and debug paths often skip the check. Confirm that failed authentication returns the same response whatever the cause, that credentials are never sent in URLs, and that rate limiting protects the sign-in and token routes.