API Authentication

Reference · Identity & Access

API Authentication Methods

Four common ways a client proves who it is to a server, ordered from least to most secret-sensitive. Each diagram shows the exchange step by step.

01

Basic Authentication

sequenceDiagram autonumber participant C as Client participant S as Server C->>S: Requests resource S->>C: Requests username/password C->>S: Sends username/password S->>C: Returns resource

Credentials travel in plaintext (Base64-encoded, not encrypted) on every request. Simple to implement, but the password is re-exposed constantly.

Not recommended for production

Secret exposure

02

Token Authentication

sequenceDiagram autonumber participant C as Client participant S as Server C->>S: User logs in S->>C: Sends encrypted token C->>S: Sends request with token S->>C: Returns resource

The client logs in once, receives a token, then sends that token with every subsequent request instead of the password itself.

Great for SPAs & mobile apps

Secret exposure

03

OAuth Authentication

sequenceDiagram autonumber participant C as Client participant U as User participant A as Auth Server participant R as Resource Server C->>U: Authorization request U->>C: Authorization grant C->>A: Authorization grant A->>C: Access token C->>R: Access token R->>C: Returns resource

A dedicated authorization server issues scoped access on the user's behalf, so the client never sees the password — only a limited-permission token.

Google / Facebook login

Secret exposure

04

API Key Authentication

sequenceDiagram autonumber participant C as Client participant S as API Server participant D as Database C->>S: Create key S->>C: Store key C->>S: Access with key S->>D: Resource authorized

Each client is issued a unique, static key that identifies and authorizes it. Lightweight, but the key must be rotated and stored carefully since it doesn't expire on its own.

Best for internal APIs & small projects

Secret exposure

Creating a NuGet Package Feed to Host Artifacts

Step-by-Step Guide: Creating a NuGet Package Feed to Host Artifacts

🔹 Step 1: Create a C# Class Library and Generate NuGet Package

1. Open Visual Studio.
2. Go to File → New → Project.
3. Select Class Library (.NET Standard) or .NET Framework.
4. Name the project (e.g., ClassLibrary1) and click Create.
5. Right-click the project in Solution Explorer and select Properties.
6. Go to the Package tab.
7. Check Generate NuGet package on build.
8. Fill in metadata fields as needed (Package ID, Version, Author, etc.).
9. Build the project in Release mode.

Note: The .nupkg file will be generated in bin\Release\.

🔹 Step 2: Set Up a NuGet Feed in Azure DevOps

1. Go to Azure DevOps Portal and log in.
2. Create a new project named Own-Artifacts.
3. Click Create.
4. In the left-hand menu, click Artifacts.
5. Click + Create Feed.
6. Enter the following:
   • Name: Feed-OwnNuGet
   • Visibility: People in your cloud user
7. Click Create.

🔹 Step 3: Publish the NuGet Package to Azure DevOps Feed

1. Ensure nuget.exe is installed and available in your system path.
2. Open a Command Prompt or Developer Command Prompt.
3. Run the following command:

nuget.exe push -Source "https://pkgs.dev.azure.com/clouduser/Own-Artifacts/_packaging/Feed-OwnNuGet/nuget/v3/index.json" -ApiKey az "D:\hc-git\ClassLibrary1\bin\Release\ClassLibrary-hc1.1.0.0.nupkg"

Note: Replace the path with the actual location of your .nupkg file.

NuGet Feed

✅ Summary

• You created a class library and generated a NuGet package.
• You set up a private NuGet feed in Azure DevOps.
• You published the package to your own feed.

Elasticsearch - Nodes, clusters, and shards

Elastic Stack Video - Load your gun in short time.

 
Beginner's Crash Course to Elastic Stack Playlist
Nodes, clusters, and shards in Elasticsearch - S1E3:Mini Beginner's Crash Course

What is Ingress

Ingress.

Enabling traffic.

• Openning the cluster to receive external traffic.

Traffic routing

• Defining the traffic routes to backend services.

Traffic Reliability

• Ensure Reliable, Secure communication.

Orchestration Tools

Orchestration Tools.

Orchestration - automation that supports processes and workflows, such as provisioning resources.

• Scale up and scale down applications on request
• Auto scale applications based on usage
• Create self-healing systems by spinning down unhealthy node and replacing them with new ones

Orchestration Tools Examples

• Docker Swarm
• kubernetes
• Zookeeper
• Terraform

Configuration Management Tools

Configuration Management Tools.

What is configuration Management?

• Resolves configuration drift
• Maintaining desired state
• The process of systematically handling chnages to a system
• Maintain integrity of a system over time
• Automation plays an key role
  • Puppet
  • Ansibel
  • Chef
  • Salt

Examples

Ansible

• Open Source
• Declarative configuration
• YAML configuration files
• No control server needed - but ansible tower available
• No agents needed, just python and ssh

Puppet

• Declarative configuration
• Manage state through a UI
• Custom modules use puppet DSL
• Pushes chnages to clients using control server and agents installed on clients.

Chef

• Procedural configuration
• Agent/Server
• Uses chef DSL

Salt

• Declarative configuration
• Agent (minions) /Server (Master) - but can support agentless
• Uses YAML
• Support for event-driven automation

Note:
Idempotent Behavior - is an operation that can be applied multiple times without changing the result beyound the initial application. E.g. 1 x 1 = 1
- Configuration management tools will avoid reapeating tasks.
- The desired state is maintained even if you run it multiple times.

Why use Configuration Management?

• Quick provisioning of New servers
• Quick Recovery from Critical Events
• No more snowflake
• Version controlfor the server Envirnment
• Replaced Environment

Build Automation Tools

Build Automation Tools.

Examples

• Java: ant, maven, gradle
• JavaScript: npm, grunt, gulp
• Packer: build machine images and containers