REST API Authentication

What is REST API?

A REST API, or Representational State Transfer Application Programming Interface, is a standardized architectural style for designing networked applications that communicate over the internet. REST APIs provide a uniform and consistent means for different software systems to interact. In a RESTful architecture, resources, such as data or services, are identified by unique URIs, and interactions with these resources are facilitated through standard HTTP methods like GET, POST, PUT, and DELETE. REST APIs are widely employed in web development, serving as a foundational technology for enabling seamless communication between diverse applications and services.

Securing APIs

Data can easily be accessed using REST API, but not everyone can access it. You can access the data by providing your username and password for authentication in the Authorization parameter in the header of the request. But is it safe to use your login credentials to access REST APIs?
No, you should avoid sharing your credentials. You can use API tokens or Access Tokens instead. REST API Plugin does this for you.

miniOrange REST API Create Keys

Using the REST API Plugin you can Authenticate APIs using the following tokens:

  • API Tokens
  • OAuth 2.0 Access Tokens
  • JWT

Here we are going to describe each of the above methods with their appropriate use cases.

Authentication Methods

API Tokens

  • If you want to protect your REST APIs from unauthenticated users but you don’t want to share login credentials to authenticate the REST API, then you can use an API token, which is a randomly generated token for you.

You can read more about API Tokens here

OAuth 2.0 Tokens

  • If you are looking to protect your REST APIs using the access token from a third-party provider/identity provider, then you should go for the OAuth 2.0 Tokens.

  • In this, you can configure third-party authentication using the following ways:

    • Authorization Grant - It is fundamentally a more secure approach, as it reduces the risk of exposing user credentials and supports access revocation, providing a more secure and flexible solution for scenarios where you are integrating third-party applications.
    • Client Credentials Grant - It can be used when APIs are accessed by trusted clients, without any user involvement. It can be used for server-to-server communication or machine-to-machine interactions.

  • Tokens from the provider can be used to authenticate Jira/Confluence/Bitbucket REST APIs.

You can read more about OAuth 2.0 Tokens here

JWT

  • If you want to protect REST API using JWT Tokens, then you can opt for this method. JWTs can either be generated using private keys or from a third-party provider.

You can read more about JWT Authentication here