7 Types
of
Authentication
in
[Link] Core
Web API
Aram Tchekrekjian @AramT87
Authentication
Authentication is the process of
identifying who is the client or
user.
It checks the identity by
answering “Who are you?”
This process ensures your API is
only accessible by a known client
or user without checking their
level of access
(that’s the role of authorization).
This document will introduce you
to the 7 types of authentication in
[Link] Core Web API @AramT87
1
No
Authentication
(Anonymous)
No Authentication
This is considered a type of
authentication, where there is no
check happens on the usage of
the API.
Any client can send requests
without credentials.
The API fully trusts the caller or
is intentionally left open.
Public APIs (weather, news).
Health check endpoints (e.g.,
/health, /status).
Internal development/testing
when security is not required.
No Authentication
@AramT87
2
Basic
Authentication
Basic Authentication
Relies on Basic Authorization
Header to verify the credentials.
The proper format should be
passed as:
base64(username:password)
In OAuth 2.0 client credentials
grant type require passing the
client id and secret in basic
authorization header.
base64(clientid:secret)
Should be only used with HTTPS
over TLS
@AramT87
Basic Authentication
@AramT87
Basic Authentication
@AramT87
3
JWT
Authentication
JWT Authentication
Client logs in once with
username/password sent via
either post body request, form-
url-encoded post request, or via
basic authentication headers.
The Server validates the
credentials and returns a JWT
token.
Client sends token on every
request in Authorization header
@AramT87
JWT Authentication
@AramT87
4
OAuth2 &
OpenID Connect
(OIDC)
OAuth2 & OIDC
Similar to JWT Authentication,
with OAuth 2.0 and OIDC the
client logs in once, but using
different flows (Grant Types).
Each based on the type of client
and use case.
OAuth2 and OIDC are industry
standards for authentication +
authorization.
These use 3 types of tokens:
Access Token
ID Token
Refresh Token
@AramT87
OAuth2 & OIDC
@AramT87
5
API Key
Authentication
API Key Authentication
Client provides a static key in
header or query.
A best practice is to compare the
hash of the key with a persisted
one. (Usually in a DB, not config)
Api Key authentication is used
for Service-to-service
communication and external
partners
Api Key rotation is advised to
reduce chances of attacks via
compromised keys
@AramT87
API Key Authentication
@AramT87
API Key Authentication
@AramT87
6
Certificate
Authentication
(mTLS)
Certificate Authentication
Also known as Mutual TLS (mTLS)
Instead of sending a header, the
client presents an X.509
certificate during the TLS
handshake.
The server validates the
certificate against trusted root
CAs and Maps cert subject to
identity.
This method is used in High-
security APIs (finance,
healthcare, B2B).
@AramT87
Certificate Authentication
@AramT87
Certificate Authentication
@AramT87
7
Windows
Authentication
(Kerberos\
NTLM)
Windows Authentication
This type of authentication uses
domain credentials in enterprise
networks.
It works best in intranet
scenarios where both the server
and client are on the same
domain or trusted domains.
Client auto-sends Kerberos ticket
or NTLM challenge.
This is usually use inside
corporate networks within
Windows Environments.
@AramT87
Windows Authentication
@AramT87
Summary
Here are the 7 types of
Authentication in
[Link] Core Web API
1. No Authentication
2. Basic Authentication
3. JWT Authentication
4. OAuth2 & OIDC
5. API Key Authentication
6. Certificate Authentication
7. Windows Authentication
@AramT87
Found this useful?
Consider Reposting
Aram Tchekrekjian @AramT87
Thank You
Follow me for more content
Aram Tchekrekjian
AramT87
Get Free Tips and Tutorials in .NET and C#
Join 1,300+ Readers
[Link]/newsletters