How do you describe authorization between services in the API specification? What protocols do you use?

Authorization between services in the API specification is usually described using standard security schemes supported by OpenAPI or other specifications. In the description, I specify:

• Type of authorization (e.g., OAuth 2.0, API key, JWT)
• Location of token transmission (Authorization header, query parameter, etc.)
• Token format and required scopes

I often use protocols such as:

• OAuth 2.0 — for delegated authorization with access tokens, especially if services belong to different domains or organizations.
• JWT (JSON Web Token) — for transmitting user information and permissions in encrypted form.
• API keys — for simple cases where service identification is needed without complex authentication.

Example in OpenAPI:

components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
security:
  - bearerAuth: []

This allows clients and services to understand how to transmit tokens and what permissions are required.