Authorization and authentication for web APIs, from token formats to the flows that issue them.
Home › API Security
Most API breaches are not exotic. They come from an authorization decision made in the wrong place: a token trusted because it parsed, a scope granted once and never narrowed, a refresh flow that outlived the session it belonged to. The guides in this category work through the mechanics of API keys, JWTs, OAuth 2.1, and OpenID Connect at the level of detail needed to actually implement them — what each field is for, which validation steps are mandatory rather than optional, and what breaks when one is skipped.
Each guide is written against the current specifications and the errata that changed them, because OAuth in particular is a family of flows whose recommended usage has shifted substantially: the implicit flow is gone, PKCE is no longer optional for public clients, and advice written for OAuth 2.0 in 2018 is now actively unsafe. Where a pattern is deprecated, we say so and name what replaced it.
By Himanshu Borikar • 2026-08-08 • 18 min read
A practical 2026 guide to API authentication — API keys, JWT, OAuth 2.1, mTLS, and HMAC compared, with real-world use cases, visual diagrams, and security best practices.
By Himanshu Borikar • 2026-07-22 • 14 min read
OAuth 2.0 explained clearly: how it works, PKCE, OAuth 2.1, security risks, and best practices - with vector diagrams, code, and a real React + Google login example.