19/01/2023, 13:09 Box Notes

Various API Authentication Methods

API authentication is the process of verifying that an API request is coming from an authorized
source.

Author: Naveen Khunteta [Naveen AutomationLabs]

Linkedin: https://www.linkedin.com/in/naveenkhunteta/

There are several types of authentication that can be used to authenticate an authorized
request, including:

1. Basic authentication: This is the simplest form of authentication, where a username and
password are sent with the API request in an encoded format. Example: An application that
connects to a database using a fixed username and password to pull data.

2. OAuth: OAuth (Open Authorization) is an open standard for token-based authentication and
authorization. It allows users to share their private resources (e.g., photos, videos, contact
lists) stored on one site with another site without having to hand out their credentials,
typically a username and password pair. Example: When a user grants a third-party
application access to their account on a social media platform using OAuth.

3. JSON Web Tokens (JWT): JSON Web Tokens are a JSON-based open standard for creating
access tokens that are sent in the Authorization header of an API request. They can be
signed using a secret key, making them secure for use in transmitting information that is
meant to be secure. Example: A user logs into an application, the application generates a
JWT, and the JWT is included in the header of every subsequent API request to authenticate
the user.

4. API keys: API keys are used to identify the calling project and to provide usage quotas and
access levels. These keys are typically passed in the header of the API request. Example: A
user wants to access a weather API and the API requires an API key to be passed with every
request.

5. Two-factor authentication: Two-factor authentication (2FA) adds an additional layer of

security to the authentication process by requiring a user to provide a second form of
verification, such as a fingerprint, in addition to their password. Example: A user logs into an

https://naveenautomationlabs.app.box.com/notes/1117481887782 1/3
19/01/2023, 13:09 Box Notes

application using their password and is prompted to enter a code sent to their mobile phone
as an additional security measure.

6. IP whitelisting: IP whitelisting is a security measure where access to an API is restricted to

specific IP addresses or ranges. Example: An application that only allows requests from a
specific IP address or range of IP addresses to access the API.

7. Mutual SSL: Mutual SSL (or two-way SSL) is a type of SSL/TLS connection where both the
client and server are authenticated during the SSL handshake process. Example: A client and
server communicate over an SSL/TLS connection, and both parties present their SSL/TLS
certificates to each other during the SSL/TLS handshake process.

8. SAML (Security Assertion Markup Language): SAML is an XML-based standard for

exchanging authentication and authorization data between parties, particularly between an
identity provider (IdP) and a service provider (SP). Example: An application that uses a third-
party identity provider for user authentication and authorization.

9. OpenID Connect: OpenID Connect is an authentication protocol built on top of OAuth 2.0.
It allows clients to verify the identity of an end-user based on the authentication performed
by an authorization server, as well as to obtain basic profile information about the end-user.
Example: An application that uses a third-party identity provider for user authentication and
retrieves user information through OpenID Connect.

10. Kerberos: Kerberos is a network authentication protocol that uses tickets to authenticate
users and servers. It is often used in enterprise environments to authenticate users against a
centralized authentication server. Example: An application that uses Kerberos authentication
to authenticate users against an Active Directory server.

11. LDAP (Lightweight Directory Access Protocol): LDAP is a protocol for accessing and
maintaining distributed directory information services. It can be used for user authentication
and authorization in a centralized directory. Example: An application that uses LDAP to
authenticate users against a centralized user directory.

12. RADIUS (Remote Authentication Dial-In User Service): RADIUS is a protocol for remote
user authentication and accounting. It is often used to authenticate users connecting to a
network through a remote access server. Example: An application that uses RADIUS to
authenticate users connecting to a VPN server.

13. DevOps authentication: DevOps authentication is used to authenticate the user who is
running a script or a code, it's mainly used to protect the access to the production servers.

https://naveenautomationlabs.app.box.com/notes/1117481887782 2/3
19/01/2023, 13:09 Box Notes

Example: An application that requires users to authenticate using SSH keys when
connecting to a production server.

14. Biometric authentication: Biometric authentication uses an individual's unique physical or

behavioral characteristics, such as fingerprints, facial recognition, or voice recognition, to
authenticate them. Example: An application that uses fingerprint recognition to authenticate
users.

15. CAPTCHA: One common method is to use a CAPTCHA service, such as Google's
reCAPTCHA, to validate that the API request is coming from a human and not a bot. This
can be done by including a CAPTCHA challenge in the API request, such as a visual puzzle or
a question, and requiring the user to solve it before the request can be processed.

https://naveenautomationlabs.app.box.com/notes/1117481887782 3/3