I need to perform sensitive REST API calls between 2 server applications that I am writing. To do this I need to be able authenticate the server that is performing the sensitive API calls.

The current architecture + what I need to add in orange:

Image of the architecture

*All servers are exposed to the internet.
What I thought to do is:

  1. Limit sensitive API calls by IP
  2. All sensitive API calls will need a secret key (do I need to use HMAC here?) that will be validated on the API server

What do you think? Is there a better way to do this?

  • 2
    Any reason you don't want to use mutual TLS?
    – Crowman
    Oct 11, 2020 at 18:07
  • @Crowman I didn't that there is such a thing as mutual TLS, I will look it up. Thanks:)
    – bodeke56
    Oct 11, 2020 at 19:43

1 Answer 1


The simplest solution is to use mutually authenticated TLS. This will only authenticate the communicating parties.

  • What do you think about JWT?
    – bodeke56
    Oct 11, 2020 at 21:37
  • 1
    Just to be clear, JWT is a token format. Not an authentication mechanism.
    – Limit
    Oct 12, 2020 at 7:37
  • JWT tokens can be used rather than mTLS. However then you will need to be able produce and validate tokens. mTLS should be available out the box.
    – Marinus
    Oct 12, 2020 at 11:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .