Scenario: I need to build a new API for a third party company who are building a tool to capture information of new users wishing to create accounts on our enterprise platform.


My preferred solution:

  • API to be secured with OAuth2.0 client_credentials flow
  • (if required) An added layer of security with Mutual TLS to validate the source of requests at a network level

However a colleague has suggested that the solution should be oAuth1.0 (unsure of which flow he has in mind)

His reasoning is :

OAuth1 is usually constrained for server-to-server authentication whereas OAuth2 can be used for secure client-to-server authentication. However OAuth2 can be used for server-to-server auth using a service account. The key issue here then is that we have not established authentication credentials of the end-user at the point of invoking the resource API, so the third party server will be authenticating against the API using a service account, not end-user credentials

I am at a loss here, because I do not see OAuth1 as allowing us to establish authentication of the end-user in anyway.

What am I missing?

  • It is my understanding that OAuth1 has largely been discontinued - largely due to the complexity it brings with cryptographic requirements with request signing.

Authenticating End-Users

If this is in fact required I see it best solved with a form of federated authorization model - Open Id with Signed JWTs - Sign in With Google / Facebook etc...

Where a token will have claims associated against them and be signed by a trusted resource.

(A total newbie with security best practice - so appreciate any guidance / help)


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.