API authentication (OAuth, JWT, API keys) in HLD - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding OAuth 2.0 Flow

Which step in the OAuth 2.0 Authorization Code flow is responsible for exchanging the authorization code for an access token?

A The client redirects the user to the authorization server's login page.

B The resource owner grants permission to the client application.

C The client sends the authorization code to the authorization server's token endpoint.

D The client uses the access token to access protected resources.

💡 Hint

Think about which step involves the client securely obtaining the token after user approval.

In OAuth 2.0 Authorization Code flow, after the user grants permission, the client receives an authorization code. The client then sends this code to the authorization server's token endpoint to exchange it for an access token.

❓ Architecture

intermediate

Choosing API Key Storage Location

Where is the most secure place to store API keys in a client-server architecture to prevent unauthorized access?

A Store API keys in environment variables on the server side.

B Store API keys in the client-side JavaScript code for easy access.

C Embed API keys directly in HTML meta tags.

D Store API keys in local storage of the user's browser.

💡 Hint

Consider where secrets should be kept hidden from users.

API keys should be stored securely on the server side, such as in environment variables, to prevent exposure to clients or users. Client-side storage exposes keys to anyone who can inspect the code or browser storage.

❓ scaling

advanced

Scaling JWT Validation in a Distributed System

In a distributed system with multiple API servers validating JWT tokens, what is the best approach to ensure consistent and scalable token validation?

A API servers store the JWT secret key and generate tokens themselves.

B Each API server fetches the public key from the authorization server on every request.

C API servers validate tokens by querying the authorization server synchronously for each request.

D API servers cache the public key locally and refresh it periodically.

💡 Hint

Think about reducing latency and load on the authorization server.

Caching the public key locally on API servers and refreshing it periodically reduces latency and avoids overloading the authorization server. Fetching on every request or synchronous validation causes performance bottlenecks.

❓ tradeoff

advanced

Tradeoffs Between OAuth and API Keys

Which statement best describes a key tradeoff when choosing between OAuth 2.0 and API keys for API authentication?

A OAuth provides fine-grained access control but is more complex to implement than API keys.

B OAuth tokens never expire, making them simpler to manage than API keys.

C API keys support delegated access and user consent flows better than OAuth.

D API keys are more secure than OAuth because they do not require token exchange.

💡 Hint

Consider complexity and control features of each method.

OAuth 2.0 supports delegated access with user consent and fine-grained permissions but requires more setup and complexity. API keys are simpler but less flexible and secure.

❓ estimation

expert

Estimating Token Storage Requirements for JWTs

You expect 1 million active users, each making 10 API requests per minute. Each JWT token is 1 KB in size and stored in a cache for 15 minutes. Approximately how much memory (in GB) is needed to store all active tokens in the cache at peak usage?

A Approximately 10 GB

B Approximately 150 GB

C Approximately 250 GB

D Approximately 100 GB

💡 Hint

Calculate how many unique tokens are active in the cache at once and multiply by token size.

Each user has one active token cached for 15 minutes. With 1 million users, total tokens cached = 1 million. Each token is 1 KB, so total memory = 1 million KB = ~1 GB. However, if tokens are refreshed every request (10 per minute), and cache holds tokens for 15 minutes, total tokens = 1 million users * 10 requests/min * 15 min = 150 million tokens, which is 150 million KB = ~150 GB. The question implies caching tokens per request, so 150 GB is correct.

Practice

1. Which of the following is the primary purpose of API authentication?

easy

A. To verify the identity of the client accessing the API

B. To encrypt the data sent between client and server

C. To improve the speed of API responses

D. To log all API requests for analytics

Solution

1. Step 1: Understand the role of authentication

   Authentication is about confirming who is making the request, not about encryption or speed.

2. Step 2: Identify the correct purpose

   Verifying the client's identity ensures only authorized users access the API.

3. Final Answer:

   To verify the identity of the client accessing the API -> Option A

4. Quick Check:

   Authentication = Verify identity [OK]

Hint: Authentication means confirming who you are [OK]

Common Mistakes:

• Confusing authentication with encryption
• Thinking authentication speeds up API
• Mixing authentication with logging

2. Which of the following is the correct format of a JWT token?

easy

A. header.payload.signature

B. username:password

C. api_key=12345

D. token|timestamp|user

Solution

1. Step 1: Recall JWT structure

   A JWT token consists of three parts separated by dots: header, payload, and signature.

2. Step 2: Match the correct format

   Only the format with three dot-separated parts matches JWT.

3. Final Answer:

   header.payload.signature -> Option A

4. Quick Check:

   JWT = header.payload.signature [OK]

Hint: JWT always has three parts separated by dots [OK]

Common Mistakes:

• Confusing JWT with basic auth format
• Using equal signs instead of dots
• Mixing API key format with JWT

3. Given this OAuth flow: A client requests an access token using a refresh token. Which response indicates a successful token refresh?

medium

A. {"refresh_token": "xyz789"}

B. {"error": "invalid_grant"}

C. {"access_token": null}

D. {"access_token": "abc123", "expires_in": 3600}

Solution

1. Step 1: Understand OAuth token refresh response

   A successful refresh returns a new access token and expiry time.

2. Step 2: Identify the success response

   {"access_token": "abc123", "expires_in": 3600} contains a valid access token and expiry, indicating success.

3. Final Answer:

   {"access_token": "abc123", "expires_in": 3600} -> Option D

4. Quick Check:

   Success = new access token returned [OK]

Hint: Success returns new access token, not error or null [OK]

Common Mistakes:

• Confusing error response with success
• Expecting refresh token in response
• Assuming null access token means success

4. A developer uses an API key in the URL query string for authentication but notices security warnings. What is the main issue?

medium

A. API keys cannot be used for authentication

B. API keys must be encrypted with RSA

C. API keys in URLs can be logged or leaked easily

D. API keys expire too quickly

Solution

1. Step 1: Analyze API key usage in URLs

   URLs are often logged by servers, browsers, and proxies, risking key exposure.

2. Step 2: Identify the security risk

   Embedding API keys in URLs can leak them unintentionally, causing security warnings.

3. Final Answer:

   API keys in URLs can be logged or leaked easily -> Option C

4. Quick Check:

   API key in URL = risk of leakage [OK]

Hint: Never put API keys in URLs to avoid leaks [OK]

Common Mistakes:

• Thinking API keys must be encrypted always
• Believing API keys can't authenticate
• Assuming keys expire too fast

5. You design an API that uses JWT for authentication. To improve security, which combination is best practice?

hard

A. Store JWTs in localStorage and never expire them

B. Use short-lived JWTs with HTTPS and validate signature on each request

C. Send JWTs in URL query parameters for easy access

D. Use JWTs without signature to reduce overhead

Solution

1. Step 1: Identify secure JWT handling practices

   Short-lived tokens reduce risk if stolen; HTTPS protects data in transit; signature validation ensures token integrity.

2. Step 2: Evaluate options for security

   Use short-lived JWTs with HTTPS and validate signature on each request follows all best practices; others expose security risks like token theft or tampering.

3. Final Answer:

   Use short-lived JWTs with HTTPS and validate signature on each request -> Option B

4. Quick Check:

   Secure JWT = short life + HTTPS + signature check [OK]

Hint: Short life + HTTPS + signature check = secure JWT [OK]

Common Mistakes:

• Storing JWTs insecurely in localStorage
• Sending tokens in URLs risking leaks
• Skipping signature validation