Glossary · Phase 8 · APIs
Authorization
Deciding what an authenticated caller is allowed to do.
Try it now
The app gets limited access, and it never sees your password.
Learn it properly
Authentication and authorization · API keys, sessions, tokens and OAuth: who's calling, and what may they do? About 45 minutes.
Other terms from the same lesson
- authentication: Proving who is making a request, with a key, a password or a token.
- JWT: A signed token carrying facts about the caller, such as who they are and when the token expires. Signed, not secret.
- OAuth: The standard way to let an app act for you on another service, without giving it your password.
- PKCE: An OAuth safeguard: the app proves it started the login with a secret only it knows, so a stolen code is useless.
Never trained an AI?
Teach a small one to write, right in your browser. It takes about 20 seconds and needs no account.