Learn API Authentication
Authentication establishes the caller. Authorisation decides which actions are permitted.
Read each short explanation, work through the example, then answer a pop quiz. Every answer explains the reasoning. Incorrect answers unlock a fresh question on the same idea; the full lesson contains ten questions.
01Understand the basics
Ready to learnAuthentication establishes who is calling. Authorisation decides what that caller can do. A JSON Web Token (JWT) can carry claims, but reading its contents proves nothing about who issued it. A verifier must check its signature and the relevant claims.
02Validate the token
Ready to learnUse a trusted verifier and an allowed algorithm. Check issuer, intended audience and time limits. Do not let untrusted token contents choose your trust policy.
Try a different value
03Limit access
Ready to learnGive credentials only the permissions and lifetime needed. Expiration reduces exposure, but authorisation is still required for each resource action. Never embed a client secret in public browser code.
You’ve practised all three sections.
First-attempt understanding and later practice are shown separately. Keep practising with the related tools or continue through the suggested path.
Put it to work
Apply what you’ve learned using the related tools.