10 steps to build a strong Token based API Security
summary
Live demo shows an OAuth flow registering a client with eBay, exchanging an authorization code for a short-lived access token and a refresh token, and using JWTs signed with a private key; recommends access vs refresh tokens, JWT structure, and by-value vs by-reference for confidentiality. Architecture uses a specific authorization server backed by a relational DB, cache and metadata service, enforces token lifecycle, strong vs eventual consistency for generation and revocation, and automates key rotation; cites Facebook revoking 90 million tokens.
AI-written summary · about
chapters (10)
- 0:00Intro
- 6:12Embrace the standards
- 13:53Maintain an extensible token architecture
- 18:16STEP 3 Learn the nuances of Cryptography
- 22:50Learn Live the nomenclature
- 26:34Choose the token format wisely (standards)
- 29:22Capture every identifier possible and use versioning
- 33:13Atomic & Strong consistency Token Generation of new tokens Token Revocation
- 34:44Identify transactional needs
- 37:29Allow only minimal scopes and least expiration time
related talks
45mModern API Authentication 101
56mSecuring an API Ecosystem with OAuth 2 0
20mOAuth 2: A closer look
47mProtect your API with OAuth2
58mOAuth – the good Parts
27mThe Nuts and Bolts of API Security: Protecting Your Data at All Times
50mOAuth2 protocol
20mBuilding a secure API: Overview of techniques and technologies needed to launch a secure API