Authentication — Complete Notes with Examples

Authentication is the process of verifying who a user or application is before granting access to a system.

Think of it like entering an office:

• Authentication = Showing your ID card to prove who you are.
• Authorization = Determining which rooms you can enter after your identity is verified.

1. Basic Authentication

What is Basic Authentication?

Basic Authentication is one of the simplest authentication methods where a username and password are sent with every request.

The credentials are combined as:

username:password

Then encoded using Base64 and sent in the HTTP header.

How it works

Step 1

User enters:

Username: rahul
Password: password123

Step 2

Create string:

rahul:password123

Step 3

Convert to Base64:

cmFodWw6cGFzc3dvcmQxMjM=

Step 4

Send in header:

GET /api/users HTTP/1.1
Host: example.com

Authorization: Basic cmFodWw6cGFzc3dvcmQxMjM=

Advantages

✅ Easy to implement

✅ Supported by almost all HTTP clients

Disadvantages

❌ Username and password are sent with every request

❌ Credentials can be exposed if HTTPS is not used

❌ No token expiration mechanism

Use Cases

• Internal applications
• Testing APIs
• Legacy systems

2. API Key Authentication

What is an API Key?

An API Key is a unique secret string assigned to a client application.

Instead of sending username/password, the application sends the key.

Example:

API_KEY = 123456abcdef789

How it works

Client sends:

GET /api/products HTTP/1.1
Host: api.company.com

x-api-key: 123456abcdef789

Server validates the key.

If valid:

Access Granted

If invalid:

401 Unauthorized

Example

Weather API:

https://api.weather.com/data?apikey=123456

Advantages

✅ Simple

✅ Good for server-to-server communication

✅ Easy to track API usage

Disadvantages

❌ API key identifies application, not the actual user

❌ If leaked, anyone can use it

❌ No built-in expiration

Use Cases

• Public APIs
• Third-party integrations
• Microservices

3. OAuth 2.0

What is OAuth 2.0?

OAuth 2.0 is an authorization framework that allows users to grant limited access to an application without sharing their password.

Example:

When you click:

Login with Google

You are using OAuth.

Real-Life Example

Imagine:

• You = Bank Account Owner
• Swiggy = Third-party App
• Bank = Authorization Server

Instead of giving your bank password to Swiggy, you allow Swiggy to access only specific information.

OAuth Actors

Resource Owner

The user.

Rahul

Client

Application requesting access.

Swiggy

Authorization Server

Issues tokens.

Google Authentication Server

Resource Server

Hosts protected resources.

Google APIs

OAuth Flow

Step 1

User clicks:

Login with Google

Step 2

Application redirects to Google:

https://accounts.google.com/oauth

Step 3

User logs in and grants permission.

Step 4

Google returns Authorization Code:

abc123xyz

Step 5

Application exchanges code for Access Token.

{
  "access_token": "eyJhbGci...",
  "expires_in": 3600
}

Step 6

Application calls APIs using token:

GET /userinfo

Authorization: Bearer eyJhbGci...

Common OAuth Flows

Authorization Code Flow

Most secure.

Used by:

• Web applications
• Enterprise applications

Client Credentials Flow

No user involved.

Service A -> Service B

Used in microservices.

Device Flow

Used by:

• Smart TVs
• IoT devices

Advantages

✅ Secure

Get Rahulbobadi’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

✅ Delegated access

✅ Tokens expire

✅ User never shares password

Disadvantages

❌ More complex

❌ Multiple moving parts

4. JWT (JSON Web Token)

What is JWT?

JWT is a compact token format used to securely transmit user information.

A JWT usually acts as an Access Token.

Example:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

JWT Structure

A JWT has three parts:

Header.Payload.Signature

Example:

xxxxx.yyyyy.zzzzz

Header

Contains metadata.

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

Contains user information.

{
  "userId": 101,
  "name": "Rahul",
  "role": "Admin"
}

Signature

Created using:

Header + Payload + Secret Key

Ensures token integrity.

JWT Example

Login Request

POST /login

Body:

{
  "username": "rahul",
  "password": "password123"
}

Server Response

{
  "token": "eyJhbGciOiJIUzI1NiIs..."
}

API Call

GET /employees

Authorization: Bearer eyJhbGciOiJIUzI1NiIs...

Advantages

✅ Stateless

✅ Fast verification

✅ Portable

✅ Widely supported

Disadvantages

❌ Cannot easily revoke before expiration

❌ Large payloads increase token size

❌ Sensitive data should not be stored inside JWT

Why OAuth is Preferred

Traditional Method

Application stores user’s password.

User → App → Password → Service

Problems:

• Password leaks
• Security risks
• Difficult password management

OAuth Method

User → Google Login → Access Token → App

Benefits:

Better Security

No password sharing.

Limited Access

Scopes define what application can access.

Example:

Read Email
Read Calendar

But not:

Delete Emails

unless explicitly granted.

Token Expiration

Access tokens expire automatically.

Easy Revocation

User can revoke access from provider.

Example:

Google Account → Security → Connected Apps

Access Token vs Refresh Token

Access Token

Used to access APIs.

Example:

eyJhbGciOiJIUzI1Ni…

Typically valid for:

15 mins - 1 hour

Example

GET /profile

Authorization: Bearer ACCESS_TOKEN

Refresh Token

Used to obtain a new Access Token when it expires.

Never used directly on APIs.

Valid for:

Days, Weeks, or Months

Flow Example

Login

Server returns:

{
  "access_token": "access123",
  "refresh_token": "refresh456"
}

API Access

Authorization: Bearer access123

Access Token Expires

Server returns:

401 Unauthorized

Client Uses Refresh Token

POST /token

{
   "refresh_token":"refresh456"
}

Server Returns New Access Token

{
   "access_token":"new_access789"
}

Quick Comparison

Interview Questions

1. What is Authentication?

Verifying the identity of a user or system.

2. Difference between Authentication and Authorization?

• Authentication = Who are you?
• Authorization = What can you access?

3. Why is OAuth better than Basic Authentication?

OAuth does not share passwords and provides token-based, limited, revocable access.

4. What is JWT?

A signed token containing claims about a user and used for stateless authentication.

5. Difference between Access Token and Refresh Token?

• Access Token → Access APIs
• Refresh Token → Generate new Access Token

6. Can OAuth use JWT?

Yes. In many implementations (Azure AD, Microsoft Entra ID, Auth0, Okta), the OAuth Access Token is often a JWT.

7. Is JWT an Authentication Protocol?

No. JWT is a token format. OAuth is an authorization framework, and OpenID Connect (OIDC) builds on OAuth for authentication.

Easy Memory Trick

Basic Auth  → Username + Password
API Key     → Application Identity
OAuth 2.0   → Delegated Authorization
JWT         → Token Format
Access Token → Access Resource
Refresh Token → Generate New Access Token

Modern enterprise stack (Microsoft Entra ID, Google, Okta, Auth0):

OAuth 2.0 + OpenID Connect + JWT Access Tokens + Refresh Tokens

This is the authentication model you’ll encounter most often in cloud applications, microservices, and enterprise systems.