API FUNDAMENTALS / LESSON 06
API Authentication.
Securing API access
Loading the lesson…
Loading activities…
Browse lessons
API FUNDAMENTALS / LESSON 06
Securing API access
Loading the lesson…
Loading activities…
Lots of APIs are open to anybody. You can check the weather or look up public info without logging in. But most APIs need to know who you are, and that's called authentication. It's how you prove your identity to an API.
There are a few really good reasons APIs make you authenticate.
Security. Without authentication, anybody could read or change your data. Imagine if any random person could read your emails or delete your photos (yikes).
Billing. Lots of APIs charge based on usage. They need to know who to send the bill to.
Rate Limiting. APIs often cap how many requests you can make per hour. They need to keep track of who's making them.
Personalization. APIs send back different data for different people. Your shopping cart isn't the same as somebody else's.
There are a handful of ways to authenticate with an API. Let's look at the most common ones.
An API key is kinda like a special password for your app. It's a long string of letters and numbers that identifies you.
When you make a request, you include this key, and the server checks whether it's valid.
How to get an API key.
Where to put the key.
Most APIs want the key in a header.
Some APIs use a query parameter instead.
Bearer tokens work like API keys, but they're usually temporary. You log in with your username and password, the API hands you a token, and that token only works for a limited time.
Send your username and password.
The API sends a token back.
Include the token in your future requests.
The word "Bearer" matters. It tells the API what kind of authentication you're using.
OAuth is a step up in complexity. It's what gets used when you want to let an app get at your data from another service WITHOUT handing over your password.
Say an app has a "Sign in with Google" button. Here's what happens.
You never gave the app your Google password. Google handled the login, and that's the safer way to do it.
Now that you know the types of authentication, let's see how the whole process actually flows. Try putting these steps in the right order to see how an API authenticates a request.
Your API keys and tokens are sensitive. If someone else gets them, they can pretend to be you.
Bad.
If that code ends up on GitHub, anybody can see your key.
Good.
The key gets stored separately from your code.
If you need to share a key with a teammate, use a secure method. Plenty of teams use password managers or secure vaults for this.
If you think a key might be out in the wild, delete it and make a new one. Most services make this pretty easy.
Most APIs use headers for authentication. Here are the patterns you'll see the most.
Bearer Token.
API Key in Header.
Basic Auth (username and password).
Let's say you're using a weather API. Here's how it goes.
Head to the weather service website and make an account.
Find the API section and generate a key. You might see something like this.
Include the key in your requests.
If the key is valid, you get data. If it isn't, you get a 401 error.
When authentication fails, you'll see specific error codes.
| Code | Meaning |
|---|---|
| 401 Unauthorized | No key/token provided, or it's invalid |
| 403 Forbidden | Key is valid, but you're not allowed to do this |
If you get a 401, run through these.
Now you've got the theory down, so it's time to put it to work. In the next lesson you'll learn how to actually make API calls from code using JavaScript's fetch() function...