Auth Basics (API Keys and Bearer)

Why auth exists

Public read-only demos are fine. Real APIs need to know who is calling and what they may do.

API keys

A key in a header or query string identifies a client. Prefer headers over query strings so keys are less likely to leak in logs and referrers.

GET /api/books
X-API-Key: YOUR_KEY

Bearer tokens

OAuth2 and many apps send Authorization: Bearer <token>. The token represents a user or client session.

Authorization: Bearer eyJhbGciOi...

Safety habits

• Use HTTPS everywhere
• Never commit keys or tokens
• Rotate secrets when leaked
• Scope tokens to least privilege
• Prefer short-lived tokens plus refresh where appropriate