Authentication and Authorization
Authentication and authorization are the core pillars of secure API access.
Following technological advancements and the latest trends in the security landscape, we've opted to use one of the most secure methods available.
For the meaning of terms and abbreviations, check out the Glossary.
mTLS
This API uses "OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens" RFC 8705.
In a more traditional approach, the caller presents proof of credentials only during authentication and in turn gets an access token. But after that, the resource server can't tell whether the access token has been stolen.
This is where mTLS comes in. During calls to both authentication and resource servers you must present an X.509 certificate and prove the ownership of the corresponding private key to establish a connection. Furthermore, the access token is usable only in a connection established by the same certificate that was used when authenticating. As a result, a stolen access token is useless without also stealing the private key and the matching certificate, which makes it that much more important to keep the private key safe - more on that in Safekeeping private key.