Training Trains Internship
Student login
← REST API Development learning path
REST API Development · Module 6 of 10

Authentication and security

Protect APIs with keys, tokens and HTTPS.

📖 Key ideas

  1. Always use HTTPS.
  2. API keys identify apps; tokens (JWT, OAuth 2.0) identify users.
  3. Send tokens in Authorization: Bearer <token>.
  4. Validate every input; never trust the client.
  5. Apply rate limiting and CORS rules.
💡 Real-life example: API security is a gated society: HTTPS is the wall, tokens are ID cards, rate limits are the guard counting visitors.
API keySecret identifying an application
OAuth 2.0Delegated authorisation standard
Bearer tokenAccess token in Authorization header
CORSBrowser rules for cross-origin calls