The big picture

You began with one question: who is calling your API, and can they prove it? Now you can choose a credential, carry it safely, guard the keys and close the gaps. This page walks one launch week through all of it.

The story you just lived

Maya's pilates studio opens its booking API to partners. Zara runs the launch review. She starts with the callers.

• Maya's browser app uses a hardened session cookie, with tokens on a backend-for-frontend.
• Sam's partner server asked for "an API key". It gets client credentials with private_key_jwt. His private key stays on his server.
• Bot A runs on the studio's cluster. It gets workload identity, with no stored secret.
• Kai books for Maya with a token Maya delegated, never her password.

Next, how credentials travel. They ride in a header, never a URL, because URLs are copied into logs and Referer headers. The gateway masks Authorization in logs. The API answers 401 for an expired token and 403 with insufficient_scope for a weak one.

Under that sits the connection. The server sends its full certificate chain. Nobody turns verification off. Sam's calls use mutual TLS with a certificate from the studio's private CA. The gateway removes any identity header a caller types in. ACME renews certificates before they expire.

The key that signs access tokens lives in a KMS, non-exportable. Rotation publishes the new key first. A webhook to Sam is signed with HMAC over the id, a timestamp and the raw body. Sam's handler checks before it parses, and ignores a retry it has seen.

Then Zara looks past credentials. Release-day bookings get business limits. The calendar import runs in an isolated fetcher, and its replies are checked like user input. The forgotten /v1 goes behind the gateway. The browser app gets a CORS allowlist with one origin. Each partner gets a token bucket, a quota, polite 429 replies and idempotency keys. Launch day is boring. That was the goal.

Six pictures to remember

• A notarized copy: a certificate is a stamp that you trust only through the chain behind it.
• A sealed courier parcel: TLS keeps the call private. Mutual TLS also checks the sender.
• A bank locker, not a flowerpot: keep keys where they can be used but not copied.
• A "payment received" SMS: check a webhook before you act on it.
• A hostel warden's list: CORS names who may read the reply.
• A tea stall with a rush: rate limits say "wait", not "never".

The threads that tie it together

Next, the AI track puts agents like Kai on the other end of your API. It starts at AI and agents. To go deeper, revisit the API gateway, DPoP and certificate-bound tokens and SPIFFE workload identity. Ready? Take the cheat sheet and pop quiz.