Medium👤 3-5 years👤 8-15 years 1 min read

API keys vs OAuth2 vs JWT — when do you use each for API auth?

Asked inAmazonMicrosoftGoogleDeloitte
#oauth2#jwt#api key#authentication#authorization
Report issue

⚡ Short Answer

API keys: simple service/server identification (no user context). OAuth2: delegated authorization — third parties act on a user's behalf without their password (access + refresh tokens). JWT: a token FORMAT often used as the OAuth2 access token. They're complementary, not competing.

Coffee Chat Question

Concept Made Simple

API keys vs OAuth2 vs JWT — when do you use each for API auth?

🧠Mind Map Answer

Remember It Faster

API keyidentify a service/app, simple
OAuth2delegated authZ, access+refresh tokens
JWTa token format (often the access token)

🔥What If?

Think Beyond the Expected

Why are short-lived access tokens + refresh tokens better than one long-lived token?

A short-lived access token limits the damage window if leaked; the refresh token (stored more securely, revocable) mints new access tokens without re-login. You get both security (short exposure) and UX (no constant logins), plus a revocation point.

😂Real World

Typical setup: OAuth2 issues short-lived JWT access tokens + refresh tokens for user-facing apps, while server-to-server integrations use API keys or client-credentials OAuth — chosen by who the caller is.

🎯Interviewer's Expectation

Keywords they're listening for:

API key = service identityOAuth2 = delegated authZJWT = format not protocolaccess vs refresh tokensshort-lived + revocation

⚠️Common Mistakes

  • Calling JWT an alternative to OAuth2
  • Long-lived access tokens with no refresh/revocation
  • Putting secrets/PII in the JWT payload

Best Practices

  • Short-lived access + refresh tokens
  • Use scopes for least-privilege
  • Validate signature, exp, audience, issuer

🔁Follow-up Questions

  • 1AuthN vs AuthZ — which does OAuth2 do?
  • 2How do you revoke a stateless JWT?
  • 3What is the client-credentials grant for?

🧩Related Technologies

OAuth2OIDCJWTAPI gateway

Continue Learning with AI

Take this question deeper with your favourite AI assistant. Pick a depth, copy the prompt, or open it directly — AI is your learning companion, not a shortcut.

Plain-language foundations

I'm preparing for a software engineering interview and want to understand this from scratch, as a beginner.

Topic: Auth (REST APIs)
Interview question: "API keys vs OAuth2 vs JWT — when do you use each for API auth?"

Please:
1. Explain the core idea in simple, plain language, using an everyday analogy.
2. Define any technical terms you use.
3. Walk through one small, concrete example.
4. Finish with a single sentence I can easily remember.

Keep the tone friendly and assume I'm new to this topic.
Open inChatGPTGeminiClaude

Was this answer helpful?

Support our platform by exploring our recommended products.

As an Amazon affiliate, purchases through these links may earn us a small commission — at no extra cost to you. It helps keep Full Stack Interview Guru free.

Related Questions