# Overview of Inter-Service Authentication Schemes

DevFeed: [Overview of Inter-Service Authentication Schemes](<https://devfeed.tech/articles/a-child-s-garden-of-inter-service-authentication-schemes-29165.md>)

Original publisher: [Read original article](<https://www.latacora.com/blog/2018/06/12/inter-service-authentication-schemes/>)

Published: 2018-06-12T20:27:00Z

Content type: article

Language: en

Sources: [Latacora](<https://devfeed.tech/sources/latacora.md>)

Topics: [Authentication](<https://devfeed.tech/topics/authentication.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [Security](<https://devfeed.tech/topics/security.md>), [servers](<https://devfeed.tech/topics/servers.md>), [passwords](<https://devfeed.tech/topics/passwords.md>), [OAuth](<https://devfeed.tech/topics/oauth.md>), [saml](<https://devfeed.tech/topics/saml.md>), [API keys](<https://devfeed.tech/topics/api-keys.md>), [Cookies](<https://devfeed.tech/topics/cookies.md>), [client](<https://devfeed.tech/topics/client.md>), [Randomizer](<https://devfeed.tech/topics/randomizer.md>), [VPC](<https://devfeed.tech/topics/vpc.md>)

Tags: [api-keys](<https://devfeed.tech/tags/api-keys.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [cookies](<https://devfeed.tech/tags/cookies.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [password](<https://devfeed.tech/tags/password.md>), [random](<https://devfeed.tech/tags/random.md>), [saml](<https://devfeed.tech/tags/saml.md>), [security](<https://devfeed.tech/tags/security.md>), [server](<https://devfeed.tech/tags/server.md>), [vpc](<https://devfeed.tech/tags/vpc.md>)

## AI overview

This article surveys server-to-server authentication and authorization schemes for systems composed of multiple services. It discusses options including bearer tokens, passwords, cookies, API keys, OAuth, and SAML, and notes risks such as token capture or logging.

## Source excerpt

Modern applications tend to be composed from relationships between smaller applications. Secure modern applications thus need a way to express and enforce security policies that span multiple services. This is the "server-to-server" (S2S) authentication and authorization problem (for simplicity, I'll mash both concepts into the term "auth" for most of this post). Designers today have a lot of options for S2S auth, but there isn't much clarity about what the options are or why you'd select any of them. Bad decisions sometimes result. What follows is a stab at clearing the question up.