Curriculum · Phase 6 · Module 6.2

API Authentication and Authorization

How an API proves who is calling (authentication) and decides what that caller may do (authorization). Covers the authentication mechanisms — API keys, JWT, OAuth2/OIDC, and mTLS — and the authorization models that sit on top of them: RBAC, ABAC, and ReBAC. Each is framed by the control requirement it satisfies and the evidence that proves it. You then choose the right auth pattern for eight real API scenarios.