API Authentication: Basic, API Key, OAuth 2.0 & JWT Explained

Types of API Authentication

API authentication ensures that only authorized users or applications can access an API.

The most commonly used authentication mechanisms are:

• Basic Authentication
• API Key Authentication
• OAuth 2.0
• JWT (JSON Web Token)
• Bearer Token Authentication

Basic Authentication

Basic Authentication is one of the simplest authentication methods.

The client sends the username and password encoded in Base64 format inside the Authorization header.

The server decodes the credentials, validates them, and grants access if they are correct.

Key Features

• Uses the Authorization header.
• Sends credentials as Base64(username:password).
• Simple to implement.
• Should always be used with HTTPS because Base64 is encoding, not encryption.

Using Basic Authentication in Postman

1. Open the Authorization tab.
2. Select Basic Auth.
3. Enter the username and password.
4. Send the request.

Postman automatically:

• Encodes the credentials in Base64.
• Adds the Authorization header.

Interview Tip:
"We used Basic Authentication for APIs with simple authentication requirements. Since Base64 only encodes credentials rather than encrypting them, we always transmitted them over HTTPS."

API Key Authentication

API Key Authentication uses a unique key instead of a username and password to authenticate API requests.

The API key acts as a unique identifier for the client application.

Key Features

• Uses a unique API key.
• Can be sent in:
  • Request headers
  • Query parameters
  • Request body
• More secure than Basic Authentication.
• The API key must remain confidential.

Best Practice

Always send API keys in the request headers instead of URL query parameters to avoid exposing sensitive information.

Interview Tip:
"We always passed API keys through HTTP headers instead of URLs to minimize the risk of exposing sensitive credentials."

OAuth 2.0

OAuth 2.0 (Open Authorization 2.0) is an industry-standard authorization framework that allows third-party applications to access user resources without exposing user credentials.

Instead of sharing usernames and passwords, OAuth issues access tokens.

Key Features

• Industry-standard authorization protocol.
• Uses access tokens.
• Eliminates password sharing.
• Widely used for third-party authentication.
• Supports secure delegated access.

Example

Google Login uses OAuth 2.0.

The application receives an access token after successful authentication and uses it to access user information.

Using OAuth 2.0 in Postman

1. Open the Authorization tab.
2. Select OAuth 2.0.
3. Configure the required OAuth settings.
4. Generate an access token.
5. Send the request.

Postman automatically attaches the access token to the request.

Interview Tip:
"We implemented OAuth 2.0 for Google Login, where the application obtained an access token to securely access user information without exposing user passwords."

JWT (JSON Web Token) Authentication

JWT (JSON Web Token) is a compact, secure, and self-contained token used for authentication and authorization.

Unlike session-based authentication, JWT is stateless, meaning the server does not need to store session information.

Structure of a JWT

A JWT consists of three parts:

• Header
• Payload
• Signature

Key Features

• Stateless authentication.
• No server-side session storage.
• Compact and secure.
• Commonly used for:
  • API authentication
  • Single Sign-On (SSO)
  • Secure information exchange

How JWT Authentication Works

1. User logs in.
2. Server validates credentials.
3. Server generates a JWT.
4. Client stores the token.
5. Client sends the token with every request.

Example request header:

Authorization: Bearer <JWT_TOKEN>

6. Server validates the token.
7. If valid, access is granted.

Using JWT in Postman

1. Open the Authorization tab.
2. Select Bearer Token.
3. Paste the JWT.
4. Send the request.

Interview Tip:
"To improve security, we used short-lived JWT access tokens, refresh tokens for renewal, and always transmitted tokens over HTTPS."

Authentication vs Authorization

Authentication and Authorization are closely related but serve different purposes.

Example

A user logs into a banking application.

• Authentication verifies the user's identity.
• Authorization determines whether the user can:
  • View account details
  • Transfer money
  • Access administrative features

Interview Tip:
"In token-based authentication, users first authenticate and receive an access token. Every subsequent API request includes that token, while authorization determines which resources the user is allowed to access based on assigned roles."

Handling Authentication Failures

Authentication failures usually return standard HTTP status codes.

401 Unauthorized

Returned when:

• Credentials are missing.
• Credentials are invalid.
• Access token has expired.
• Authentication token is malformed.

403 Forbidden

Returned when:

• The user is authenticated.
• The user does not have permission to access the requested resource.

During API Testing, Verify That

• The correct HTTP status code is returned.
• Error messages are meaningful.
• Expired tokens are rejected.
• Invalid tokens are rejected.
• Missing tokens are rejected.
• Protected APIs cannot be accessed without authentication.

Security Best Practices

• Use HTTPS for all authenticated requests.
• Use short-lived access tokens.
• Implement refresh tokens.
• Never expose credentials in URLs.
• Store authentication tokens securely.

Interview Tip:
"While testing authentication, we verified that invalid, expired, and missing tokens correctly returned 401 Unauthorized, while users without sufficient permissions received 403 Forbidden responses."

FAQs

What are the different types of API authentication?

The most common API authentication mechanisms are:

• Basic Authentication
• API Key Authentication
• OAuth 2.0
• JWT (JSON Web Token)
• Bearer Token Authentication

What is Basic Authentication?

Basic Authentication sends the username and password encoded in Base64 format inside the Authorization header. Since Base64 is not encryption, it should always be used with HTTPS.

What is API Key Authentication?

API Key Authentication uses a unique API key to authenticate requests. The key should be kept secret and preferably sent in the request headers instead of URL parameters.

How does OAuth 2.0 work?

OAuth 2.0 issues access tokens that allow third-party applications to access user resources without exposing user credentials. It is commonly used for services such as Google Login.

What is JWT Authentication?

JWT Authentication uses a stateless token containing a Header, Payload, and Signature. The token is generated after login and sent with every request using the Authorization: Bearer header.

What is the difference between Authentication and Authorization?

• Authentication verifies the user's identity (Who are you?).
• Authorization determines what the authenticated user is allowed to access (What can you do?).