Recall that API is an interface that enables an application access data from a server. In some cases, it is easy for one to make a request without some restrictions. In such cases, we call them Public or External APIs. These APIs are openly accessible by anyone and everyone who wants to utilize the functions behind the APIs. While we have the public APIs, we have the Private or Internal APIs which are limited to use by the team, department, company, or organization. Finally, we have Partner APIs, this is restricted to use by only specific partners outside the API provider’s organization. For the Internal and Partner APIs, there is every need to put in some level of security to restrict an unauthorized user from accessing the service meant for specific people. This idea of security does not only restrict access to the services but restricts the extent of use of the services i.e you may be granted access to an API but if the API has various scope, you will only to able to access the scope specific to your demand or request.

This brings us to understand the difference between Authentication and Authorization. Authentication identifies a user and allows access to a resource depending on the user while Authorization restricts a user to a specific scope of the resources for resources that are divided into scopes. A typical scenario is; when someone knocks on your door, you ask who the person is and if the person is familiar like a relative, friend or someone you were expecting. You will let him in. That’s authentication. Depending on the person, there will be rooms accessible to him and how long he would be allowed to stay at your house. This is an authorization. In other words, Authentication verifies who you are and Authorization verifies what you have access to.

In the case of Private or Partner APIs, users will have to sign up for the service through a designed portal or contact a salesperson to generate an account. This will provide the authentication credentials needed to access the information provided by an API. The process of getting access to the information or resources is an authorization which is superseded by the authentication layer or method.

There are various authentication methods used in securing APIs but the most common ones are;

• OAuth 2.0

• OpenID Connect

• API Keys

• HTTP Authentication Schemes (Basic, Bearer).