Tell me about authorization in API.

API authorization is the process of verifying the identity of a user or application making a request to the API and granting access according to their permissions.

Main types of API authorization:

• Basic Authentication: Sending a username and password in the Authorization header encoded in Base64. Simple but not secure (transmitting credentials in plain, albeit encoded, form).
• API Key: Sending a unique key in the header, request parameter, or request body. The key is associated with a specific user/application and is used for identification and access control. Less secure when transmitted in URL.
• OAuth 2.0: An authorization standard allowing third-party applications to obtain limited access to user data on behalf of the user without revealing their credentials. Based on access tokens.
  • Authorization Code Grant (for web applications)
  • Implicit Grant (for single-page applications)
  • Resource Owner Password Credentials Grant (less secure)
  • Client Credentials Grant (for server-to-server interactions)
• JWT (JSON Web Token): A compact, URL-safe way of representing claims between two parties. JWT consists of three parts (Header, Payload, Signature), separated by dots. Used for transmitting information and authentication. Often used with OAuth 2.0 as an access token.
• Bearer Token: Indicates that the token holder has access rights to the resource. The token is sent in the Authorization header in the format Bearer <token>. Usually used with OAuth 2.0 and JWT.
• Session-Based Authentication: After successful login, the server creates a session for the user and sends a Session ID (usually in a cookie). In subsequent requests, the client sends the Session ID, and the server identifies the user by it. More common in web applications but also found in APIs.

The choice of authorization method depends on:

• Client type (web, mobile, server-to-server).
• Security requirements.
• Implementation complexity.
• Availability of third-party resources that require access.

Example of using a Bearer token in a request (using curl):

# Example request with Authorization Bearer Header
curl -X GET 'https://api.example.com/resource' \
-H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...'