Microservice APIs

11 API authorization and authentication

This chapter covers

• Using Open Authorization to allow access to our APIs
• Using OpenID Connect to verify the identity of our API users
• What kinds of authorization flows exist, and which flow is more suitable for each authorization scenario
• Understanding JSON Web Tokens (JWT) and using Python’s PyJWT library to produce and validate them
• Adding authentication and authorization middleware to our APIs

In 2018, a weakness in the API authentication system of the US postal system (https://usps.com) allowed hackers to obtain data from 60 million users, including their email addresses, phone numbers, and other personal details.¹ API security attacks like this have become more and more common, with an estimated ...