Module 4 of 6Lesson 1 of 2~18 min
API keys, tokens and OAuth 2.0, choosing and specifying
How an integration authenticates shapes your users' journey and your level of risk. This lesson compares the main families, from a simple key to OAuth 2.0, and helps you choose, then specify the minimum permissions, the sign-in flow and how secrets are handled.
Lesson objective
By the end of this lesson, you will be able to choose the authentication method suited to an integration (API key, token, OAuth 2.0 and its flow), specify the minimal scopes and the connection journey, and write the rules for managing secrets.
Topics covered
- OAuth 2.0
- API key
- access tokens
- scopes
- secrets management
In the glossary
Where it fits
Authentication, permissions and security
Who may call the API, to do what, and how do you avoid the most common flaws?
Lessons in this module
- API keys, tokens and OAuth 2.0, choosing and specifying (this lesson)
- The API flaws a PM should know how to spot
What you will learn in this module
This lesson is part of the course Design and test an API integration as a PM
- Choose and specify the authentication method (API key, token, OAuth 2.0), the minimal permissions and the rules for managing secrets.
Related courses
- Product ManagementAdvancedRegular practice: you already use the tools or work on this topic.
Git for PMs: ship as a team without putting production at risk
3 hr 30 min
- Tech for PMsAll levelsNo prerequisites: accessible to everyone.
Explain how a web product works, from browser to server
2 hr 30 min
- Tech for PMsJuniorSome basics are useful: introductory knowledge of the topic.
Model your product’s data and query it with SQL
3 hr 30 min