Secure API authentication with JWT, OAuth 2.0, API keys. Use for authentication systems, third-party integrations, service-to-service communication, or encountering token management, security headers, auth flow errors.

API Authentication Implement secure authentication mechanisms for APIs using modern standards and best practices. Authentication Methods Method Use Case Security Level JWT Stateless auth, SPAs High OAuth 2.0 Third party integration High API Keys Service to service Medium Session Traditional web apps High JWT Implementation (Node.js) Security Requirements Always use HTTPS Store tokens in HttpOnly cookies (not localStorage) Hash passwords with bcrypt (cost factor 12+) Implement rate limiting on auth endpoints Rotate secrets regularly Never transmit tokens in URLs Security Headers Additional Implementations See [references/python flask.md](references/python flask.md) for: Flask JWT with role based access control decorators OAuth 2.0 Google integration with Authlib API key authentication with secure hashing Common Mistakes to Avoid Storing plain text passwords Using weak JWT secrets Ignoring token expiration Disabling HTTPS in production Logging sensitive tokens

api-authentication