Building ApplicationsLesson 45Free preview

API Authentication

This lesson is part of Node.js · All levels

Summary

API authentication verifies the identity of the client, whereas authorization determines what can be accessed after login. Commonly used methods are Basic Auth, API Key, and JWT based Bearer tokens. The best practice is to always use HTTPS, keep hash passwords, and allow a reasonable token validity time.

Key points

JWT contains a header, payload, and a validated signature on the server
Save the password as hash (bcrypt/argon2), not as plain text
Send the token through the header Authorization: Bearer
Refresh token allows extended access without re-logging

Full lesson

Code examples and quizzes

Full lessons, code examples, and quizzes are available to subscribers. 5 questions.