API keys vs OAuth2 vs JWT — when do you use each for API auth?
⚡ Short Answer
API keys: simple service/server identification (no user context). OAuth2: delegated authorization — third parties act on a user's behalf without their password (access + refresh tokens). JWT: a token FORMAT often used as the OAuth2 access token. They're complementary, not competing.
☕Coffee Chat Question
Concept Made Simple
“API keys vs OAuth2 vs JWT — when do you use each for API auth?”
🧠Mind Map Answer
Remember It Faster
🔥What If?
Think Beyond the Expected
Why are short-lived access tokens + refresh tokens better than one long-lived token?
A short-lived access token limits the damage window if leaked; the refresh token (stored more securely, revocable) mints new access tokens without re-login. You get both security (short exposure) and UX (no constant logins), plus a revocation point.
😂Real World
Typical setup: OAuth2 issues short-lived JWT access tokens + refresh tokens for user-facing apps, while server-to-server integrations use API keys or client-credentials OAuth — chosen by who the caller is.
🎯Interviewer's Expectation
Keywords they're listening for:
⚠️Common Mistakes
- ✗Calling JWT an alternative to OAuth2
- ✗Long-lived access tokens with no refresh/revocation
- ✗Putting secrets/PII in the JWT payload
✅Best Practices
- ✓Short-lived access + refresh tokens
- ✓Use scopes for least-privilege
- ✓Validate signature, exp, audience, issuer
🔁Follow-up Questions
- 1AuthN vs AuthZ — which does OAuth2 do?
- 2How do you revoke a stateless JWT?
- 3What is the client-credentials grant for?
🧩Related Technologies
Continue Learning with AI
Take this question deeper with your favourite AI assistant. Pick a depth, copy the prompt, or open it directly — AI is your learning companion, not a shortcut.
Plain-language foundations
I'm preparing for a software engineering interview and want to understand this from scratch, as a beginner. Topic: Auth (REST APIs) Interview question: "API keys vs OAuth2 vs JWT — when do you use each for API auth?" Please: 1. Explain the core idea in simple, plain language, using an everyday analogy. 2. Define any technical terms you use. 3. Walk through one small, concrete example. 4. Finish with a single sentence I can easily remember. Keep the tone friendly and assume I'm new to this topic.
Was this answer helpful?
⭐ Featured Products
Support our platform by exploring our recommended products.
As an Amazon affiliate, purchases through these links may earn us a small commission — at no extra cost to you. It helps keep Full Stack Interview Guru free.