API authentication (OAuth, JWT, API keys) in HLD - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the main purpose of API authentication?

API authentication ensures that only authorized users or systems can access the API, protecting data and services from unauthorized use.

beginner

Explain OAuth in simple terms.

OAuth is a way to let users give permission to apps to access their data without sharing passwords. It uses tokens to grant limited access.

intermediate

What is a JWT and what does it contain?

JWT (JSON Web Token) is a compact token that contains encoded information like user identity and permissions, signed to prevent tampering.

intermediate

How do API keys differ from OAuth tokens?

API keys are simple static strings used to identify the client, while OAuth tokens are dynamic, time-limited, and can carry user permissions.

beginner

Why is it important to use HTTPS with API authentication?

HTTPS encrypts data between client and server, protecting sensitive authentication tokens and credentials from being stolen by attackers.

Which of the following is a key feature of OAuth?

A Allows users to share passwords with third-party apps

B Uses tokens to grant limited access without sharing passwords

C Is a static API key used for client identification

D Encrypts data between client and server

OAuth uses tokens to let apps access user data without sharing passwords.

What does a JWT typically include?

A User credentials in plain text

B Encrypted user password

C Encoded user identity and permissions with a signature

D A static API key

JWT contains encoded user info and permissions, signed to prevent tampering.

API keys are best described as:

A Static strings identifying the client

B Dynamic tokens with expiration

C Encrypted user passwords

D OAuth authorization codes

API keys are static strings used to identify clients.

Why should API authentication always use HTTPS?

A To speed up API responses

B To store tokens on the client

C To allow anonymous access

D To encrypt authentication data and prevent interception

HTTPS encrypts data, protecting tokens and credentials from attackers.

Which authentication method allows users to grant limited access to their data without sharing passwords?

A OAuth

B Basic Authentication

C API keys

D JWT

OAuth lets users grant limited access using tokens without sharing passwords.

Describe how OAuth works to authenticate API requests.

Think about how apps ask for permission to use your data.

Explain the differences between API keys, JWT, and OAuth tokens.

Consider how each method handles security and access control.