8

I have read multiple pages/blog posts on API key vs JWT and still I'm confused when to use one of them. Most recent one are saying that JWT became a standard for API authentication but then it became confusing for me in few cases described below.

JWT "no-brainer" choice is for any UI app which will need to authenticate user as well any API calls which require authorization on the API not just authentication.

Then to voice came up APIs which requires only authentication and do not need to identify individual user. JWT in that case looks like an overkill.

On another hand how does it look when JWT is used by API (direct call, no UI) and is not "static" and that will require to generate refresh token for it. How in a general way API should to handle it? Should be that done per each request?

3

1 Answer 1

8

JWT "no-brainer" choice is for any UI app which will need to authenticate user as well any API calls which require authorization on the API not just authentication.

Both API key and JWT can provide authentication and authorization. API key is on project scope and JWT is on user scope.

API keys are considered to be vulnerable to man-in-the-middle attacks, so not as secure as authentication tokens (refer to Google Cloud API key doc).

Example use case for API keys is using Endpoints features such as quotas. Each request must pass in an API key so that Endpoints can identify the project that the client application is associated with.

Example use case for JWT is authentication between Microservices. Refer to this doc for details on use case with more than this two authentication method.

how does it look when JWT is used by API (direct call, no UI) and is not "static" and that will require to generate refresh token for it. How in a general way API should to handle it? Should be that done per each request?

When the client logs in, the authorization server API issues access token and refresh token, and sends them back to client in response. They are both JWT but refresh token is much long-lived compared with access token. The client stores the access token in the HttpOnly cookies. Refresh tokens are usually subject to strict storage requirements to ensure they are not leaked. Until the access token expires, the client uses it to call the API endpoint. When it expires, the client sends the refresh token to the auth-server, and the server issues new access token.

Please refer to this article for more details on refresh tokens.

Note you may not have to store and use refresh token at all.

1
  • This is a good answer except 1) JWTs do not mean identity. Some do, some do not. This depends on the Identity Provider. 2) JWTs do not mean user scope. Some JWTs (e.g. Google) sometimes use JWTs for project-level access tokens and sometimes for OIDC identity tokens. Again this depends on the Identity Provider. Apr 21 at 5:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.