IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Start here: who is calling your API?
Every app you use talks to an API. Maya's banking app, Bot A's nightly job, Sam's partner system and Kai the AI agent all call APIs. The API asks one thing first: who is calling? Your goal: know how callers prove who they are, and which mistakes leave an API open.
- Most API callers are programs, not people.
- Programs prove who they are with keys, tokens and certificates.
- Each of these can leak, so guard them.
Why API security is its own skill
A login page has a person in front of it. An API usually does not. Its callers are programs, and each one is a workload. A person can type a password or tap a passkey. A program cannot.
A program uses API keys, tokens, private keys or certificates. Each one can leak into a log, a code repository or a backup. A valid request can still be abuse.
New to some ideas? Read keys and signatures, the Tokens track, machine login and HTTP basics first.
You already know these pictures
The hard ideas in this track have everyday twins. Here are six. Each lesson gives its picture a real name.
📜 A notarized copy
A notary checks your ID once, then stamps the paper. A bank trusts the stamp, not you. This is a certificate.
📦 A sealed courier parcel
Nobody on the road can open it or swap what is inside. This is TLS.
🏦 A bank locker, not a flowerpot
A key under the flowerpot can be copied in silence. A locker is opened in front of staff, and a register records every visit. This is key storage.
💸 A "payment received" message
Anyone can type that SMS. Careful owners check the bank app. A webhook signature is that check, built in.
🏨 A hostel warden's list
Anyone may knock at the gate. The warden gives the reply only to visitors named on the list. This is CORS.
🍵 A tea stall with a rush
The stall serves a fixed number of people a minute. The rest hear "wait two minutes". This is a rate limit.
The journey
- The API sign-in menu
- Basic, bearer and the Authorization header
- Certificates and chains of trust
- TLS and mutual TLS
- Guarding private keys
- Signed requests and webhooks
- More ways APIs break
- CORS and browser-facing APIs
- Rate limits, quotas and abuse control
- The big picture
- Cheat sheet and pop quiz
Every lesson has a hands-on lab. No lab makes a real network call.
You will choose how each caller signs in. You will read a certificate chain. You will guard keys and spot common API mistakes.
Begin with the API sign-in menu.