Tell about the process of authorization in APIs and…

API authorization is the process of verifying a client's access rights to server resources. The main methods of authorization:

Basic Authentication:
- Sending a username and password, encoded in Base64, in the Authorization header.
- Simple but insecure (password is transmitted, albeit encoded). Requires HTTPS.
```
GET /resource HTTP/1.1
Host: api.example.com
Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ= // Encoded "username:password"
```
API Key:
- Sending a unique key generated by the server, in the HTTP header (e.g., X-API-Key) or as a query parameter (?apiKey=...).
- Easy to implement, but the key can be intercepted. Does not provide user information.
```
GET /resource HTTP/1.1
Host: api.example.com
X-API-Key: your_secret_api_key
```
```
GET /resource?apiKey=your_secret_api_key HTTP/1.1
Host: api.example.com
```
OAuth 2.0:
- Authorization protocol allowing third-party services to access user data with limited permissions without sharing credentials.
- Uses tokens (access token, refresh token).
- Different flows (authorization code, implicit, client credentials, resource owner password credentials) for various scenarios.
- More complex but secure and flexible.
Process (for authorization code flow):
- Client redirects user to authorization server.
- User grants permission.
- Authorization server redirects back with an authorization code.
- Client exchanges the code for an access token (and refresh token) at the authorization server.
- Client uses the access token to access resources on the resource server.
```
GET /resource HTTP/1.1
Host: api.example.com
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... // access token
```
JWT (JSON Web Tokens):
- Self-contained tokens containing user information and permissions as a JSON object, cryptographically signed.
- OAuth 2.0 often uses JWT as the format for access tokens.
- Server can verify the token's signature without database access.
- Tokens can expire (using refresh tokens to obtain new access tokens).
```
// Example JWT payload
{
  "sub": "1234567890", // subject (user ID)
  "name": "John Doe",
  "iat": 1516239022, // issued at
  "exp": 1516242622 // expiration
}
```
Session-based Authentication:
- After successful login, the server creates a session stored on the server and sends a session ID to the client as a cookie.
- The client sends the session ID with each subsequent request via cookie.
- Less suitable for distributed APIs (microservices), as it requires sticky sessions or shared session storage.
```
GET /resource HTTP/1.1
Host: api.example.com
Cookie: SessionID=abcdef123456
```

The choice of method depends on security requirements, client type (browser, mobile app, server), the need to provide access to third-party services, and implementation complexity. The most common and secure approach for modern APIs is using OAuth 2.0 with JWT.

Tell about the process of authorization in APIs and the methods used for it.