Why do users and programs have different client authentication mechanisms?

Question

Typically in any application, the way a user (human) is authenticated is using a username/id and a password, whereas programmatic or api based access is authenticated using API keys (based on system designs that I have seen online).

Other than one reason that usernames and passwords work for humans because they're easy to remember vs machines which can work with arbitrary strings, is there any benefit of choosing one over the other ?

I say typically because AWS for eg., Uses an Id and a secret key (AWS Credentials) for programmatic access as well. Is there any additional benefit of having one public and one secret credential over having just one secret ?

Also, in case of humans, auth tokens are used to avoid credential verification / login for every call to an application. What are the techniques used for the same purpose when two machines/programs are communicating ?

Answer 1

is there any benefit of choosing one over the other ?

Technically - no. As you mentioned, for humans it is much easier to remember username and password. A client application can store a huge public key and use it...

What are the techniques used for the same purpose when two machines/programs are communicating ?

There are several techniques. A commons one is: There should be an API for "login" that returns a token. This token has an expiration of a configurable time. Each call from the client machine should pass this token in the header (e.g. Authorization header), and the server should verify this token.

The verification of the token should be very quick, much quicker that processing the authentication (i.e. the login call).