API Design · Middle · Question 35 of 75

How should service-to-service calls inside a system be authenticated?

1By sending the end user's password
✓Correct answer: With machine credentials, e.g. OAuth client credentials, signed tokens or mTLS, not by trusting the network
3Internal calls don't need authentication

Explanation

Zero-trust thinking: an attacker inside the network shouldn't automatically reach every service.

Further reading

Test yourself

Take the API Design · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.