API authentication (OAuth, JWT, API keys) in HLD - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to identify the type of token used for API authentication.

HLD

if token_type == '[1]':
    print("Use OAuth for user authorization")

Drag options to blanks, or click blank then click option'

AJWT

BOAuth

CAPIKey

DSession

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing API keys with OAuth tokens.

OAuth is a common token type used for user authorization in APIs.

2fill in blank

medium

Complete the code to decode a JWT token payload.

HLD

payload = decode_jwt(token).[1]

Drag options to blanks, or click blank then click option'

Aclaims

Bheader

Csignature

Dpayload

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'header' or 'signature' instead of 'payload'.

The payload part of a JWT contains the claims and user data.

3fill in blank

hard

Fix the error in the API key validation logic.

HLD

if api_key == [1]:
    grant_access()

Drag options to blanks, or click blank then click option'

A12345-ABCDE

Bapi_key

C"12345-ABCDE"

DNone

Attempts:

3 left

💡 Hint

Common Mistakes

Not using quotes around the API key string.

API keys are strings and must be compared as strings with quotes.

4fill in blank

hard

Fill both blanks to complete the OAuth token request flow.

HLD

response = request_token(client_id=[1], grant_type=[2])

Drag options to blanks, or click blank then click option'

A"my_client_id"

B"authorization_code"

C"refresh_token"

D"client_secret"

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'refresh_token' grant type for initial token request.

The client ID is a string identifier, and the grant type for initial OAuth token is 'authorization_code'.

5fill in blank

hard

Fill all three blanks to complete the JWT verification step.

HLD

if verify_signature(token=[1], secret=[2]) and check_expiry(token=[3]):
    allow_access()

Drag options to blanks, or click blank then click option'

Ajwt_token

Bsecret_key

Ctoken

Daccess_token

Attempts:

3 left

💡 Hint

Common Mistakes

Using different variable names inconsistently for the token.

The token parameter should be the JWT token variable, and the secret is the key used to verify the signature.

Practice

1. Which of the following is the primary purpose of API authentication?

easy

A. To verify the identity of the client accessing the API

B. To encrypt the data sent between client and server

C. To improve the speed of API responses

D. To log all API requests for analytics

Solution

1. Step 1: Understand the role of authentication

   Authentication is about confirming who is making the request, not about encryption or speed.

2. Step 2: Identify the correct purpose

   Verifying the client's identity ensures only authorized users access the API.

3. Final Answer:

   To verify the identity of the client accessing the API -> Option A

4. Quick Check:

   Authentication = Verify identity [OK]

Hint: Authentication means confirming who you are [OK]

Common Mistakes:

• Confusing authentication with encryption
• Thinking authentication speeds up API
• Mixing authentication with logging

2. Which of the following is the correct format of a JWT token?

easy

A. header.payload.signature

B. username:password

C. api_key=12345

D. token|timestamp|user

Solution

1. Step 1: Recall JWT structure

   A JWT token consists of three parts separated by dots: header, payload, and signature.

2. Step 2: Match the correct format

   Only the format with three dot-separated parts matches JWT.

3. Final Answer:

   header.payload.signature -> Option A

4. Quick Check:

   JWT = header.payload.signature [OK]

Hint: JWT always has three parts separated by dots [OK]

Common Mistakes:

• Confusing JWT with basic auth format
• Using equal signs instead of dots
• Mixing API key format with JWT

3. Given this OAuth flow: A client requests an access token using a refresh token. Which response indicates a successful token refresh?

medium

A. {"refresh_token": "xyz789"}

B. {"error": "invalid_grant"}

C. {"access_token": null}

D. {"access_token": "abc123", "expires_in": 3600}

Solution

1. Step 1: Understand OAuth token refresh response

   A successful refresh returns a new access token and expiry time.

2. Step 2: Identify the success response

   {"access_token": "abc123", "expires_in": 3600} contains a valid access token and expiry, indicating success.

3. Final Answer:

   {"access_token": "abc123", "expires_in": 3600} -> Option D

4. Quick Check:

   Success = new access token returned [OK]

Hint: Success returns new access token, not error or null [OK]

Common Mistakes:

• Confusing error response with success
• Expecting refresh token in response
• Assuming null access token means success

4. A developer uses an API key in the URL query string for authentication but notices security warnings. What is the main issue?

medium

A. API keys cannot be used for authentication

B. API keys must be encrypted with RSA

C. API keys in URLs can be logged or leaked easily

D. API keys expire too quickly

Solution

1. Step 1: Analyze API key usage in URLs

   URLs are often logged by servers, browsers, and proxies, risking key exposure.

2. Step 2: Identify the security risk

   Embedding API keys in URLs can leak them unintentionally, causing security warnings.

3. Final Answer:

   API keys in URLs can be logged or leaked easily -> Option C

4. Quick Check:

   API key in URL = risk of leakage [OK]

Hint: Never put API keys in URLs to avoid leaks [OK]

Common Mistakes:

• Thinking API keys must be encrypted always
• Believing API keys can't authenticate
• Assuming keys expire too fast

5. You design an API that uses JWT for authentication. To improve security, which combination is best practice?

hard

A. Store JWTs in localStorage and never expire them

B. Use short-lived JWTs with HTTPS and validate signature on each request

C. Send JWTs in URL query parameters for easy access

D. Use JWTs without signature to reduce overhead

Solution

1. Step 1: Identify secure JWT handling practices

   Short-lived tokens reduce risk if stolen; HTTPS protects data in transit; signature validation ensures token integrity.

2. Step 2: Evaluate options for security

   Use short-lived JWTs with HTTPS and validate signature on each request follows all best practices; others expose security risks like token theft or tampering.

3. Final Answer:

   Use short-lived JWTs with HTTPS and validate signature on each request -> Option B

4. Quick Check:

   Secure JWT = short life + HTTPS + signature check [OK]

Hint: Short life + HTTPS + signature check = secure JWT [OK]

Common Mistakes:

• Storing JWTs insecurely in localStorage
• Sending tokens in URLs risking leaks
• Skipping signature validation