Interactive architecture advice
Which API Authentication Pattern?
Answer a few questions to explore a suggested pattern and its trade-offs. Each answer explains why it fits, what you gain and what to check before putting it into practice.
Authentication establishes the caller. Authorisation limits what they may do. The right credentials depend on the caller and whether it is acting on behalf of a user.
01Your requirements
A user application represents a person; a workload calls as a service; a webhook pushes an event.
Delegation means the caller needs limited access on someone else’s behalf, rather than unrestricted shared credentials.
Suggested pattern
Answer the questions to explore a starting pattern.
Architecture depends on workload, risk, team capability and constraints. Validate assumptions and evaluate a small proof of concept; this is a starting point for your design.
Turn this into a practical decision
- List who calls, which resources they need and which actions are allowed.
- Use a maintained identity or verification library and short credential lifetimes where practical.
- Test expiry, wrong audiences, replay and access to another user’s resources.