IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
API keys vs OAuth
Bot A must call the billing API at 3 a.m. No human is there to type a password. What does the bot carry? Your goal: choose the right credential for a program, and know why a short-lived token beats a static key.
- A static API key never expires and names nobody but its holder.
- Client credentials give a short-lived, scoped token. A leak fixes itself.
- Best: no stored secret at all, using workload identity.
- A plain key is fine only if a leak cannot hurt.
The static API key: easy today, painful later
A static API key is a long random string that you paste into a request header. It is easy. There is no login step and no expiry. That ease is the problem.
- It never expires, so a copy works forever.
- It names nobody except "whoever holds this string". The server cannot tell Bot A from a thief.
- It ends up in a repo, a CI setting or a chat thread.
- Changing it breaks every caller at once, unless old and new keys overlap.
Bots already outnumber your people (see non-human identities). An immortal secret for each one does not scale.
Client credentials: expiry as the safety net
The standard answer is the client credentials grant of OAuth 2.0. Bot A signs in at the token endpoint. It gets a short-lived, scoped access token that works for minutes, not forever. Three things change. A leaked token is useless when it gets old, the same idea behind refresh-token rotation. Every token carries a client_id, so logs can name the caller. And one switch at the authorization server cuts Bot A off everywhere.
a house key and a hotel keycard. A static key is the house key you copied ten years ago. You have lost track of who has a copy. A token is a hotel keycard. It opens only your floor and dies at checkout.
Go further: no shared secret
Even a short-lived token starts from a client secret that Bot A must store. You can remove the shared secret. With mutual TLS (mTLS) or private_key_jwt, Bot A holds a private key and proves it owns the key. The secret never travels on the wire.
Better still, workload identity lets the platform vouch for the program. Bot A gets a short-lived identity at run time because of where it runs. This is the SPIFFE model. No lasting secret is stored, so none can leak.
| Credential | Expires? | Names the caller? | Secret that can leak? |
|---|---|---|---|
| Static API key | Never (changed by hand) | No | Yes: the whole key |
| Client secret → access token | Token: minutes | Yes (client_id) | Yes: the client secret |
private_key_jwt / mTLS | Token: minutes | Yes | No: the private key is never sent |
| Workload identity (SPIFFE) | Minutes (automatic) | Yes (SVID) | Nothing stored |
The API authentication menu compares the full list, with a guide to choose.
When a plain key is fine
A static key is fair for public, read-only data, such as a weather feed. It can also be a plain label to tell callers apart, for rate limits. The test is simple. If a leaked key cannot move money, read private data or change anything, accept it. Anything above that line needs a short-lived token.
Go deeper: standards behind these choices
The client credentials grant is part of OAuth 2.0 (RFC 6749), and the OAuth 2.1 draft keeps it. Mutual TLS and private_key_jwt are two ways for a client to prove who it is without a shared secret. In SPIFFE, the short-lived identity document is called an SVID.
🧪 Interactive lab — enable JavaScript to play with this one.
Want to drop shared secrets? Build and check a private_key_jwt with Client Assertion Check. Decode a workload's SPIFFE identity with SPIFFE Scan. Next: where all these credentials get checked, the API gateway.